Judgment of 10 Jul 2018, C-25/17 (Jehovan todistajat)
JUDGMENT OF THE COURT (Grand Chamber)
10 July 2018 (*)
(Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Scope of the directive — Article 3 — Data collected and processed by the members of a religious community in the course of their door-to-door preaching — Article 2(c) — Definition of a ‘personal data filing system’ — Article 2(d) — Definition of a ‘controller’ of the processing of personal data — Article 10(1) of the Charter of Fundamental Rights of the European Union)
In Case C-25/17,
REQUEST for a preliminary ruling under Article 267 TFEU from the Korkein hallinto-oikeus (Supreme Administrative Court, Finland), made by decision of 22 December 2016, received at the Court on 19 January 2017, in the proceedings
Tietosuojavaltuutettu
intervening parties:
Jehovan todistajat — uskonnollinen yhdyskunta,
THE COURT (Grand Chamber),
composed of K. Lenaerts, President, A. Tizzano, Vice-President, R. Silva de Lapuerta, T. von Danwitz (Rapporteur), J.L. da Cruz Vilaça, J. Malenovský, E. Levits and C. Vajda, Presidents of Chambers, A. Borg Barthet, J.-C. Bonichot, A. Arabadjiev, S. Rodin, F. Biltgen, K. Jürimäe and C. Lycourgos, Judges,
Advocate General: P. Mengozzi,
Registrar: C. Strömholm, Administrator,
having regard to the written procedure and further to the hearing on 28 November 2017,
after considering the observations submitted on behalf of:
– the tietosuojavaltuutettu, by R. Aarnio, acting as Agent,
– Jehovan todistajat — uskonnollinen yhdyskunta, by S.H. Brady, asianajaja, and by P. Muzny,
– the Finnish Government, by H. Leppo, acting as Agent,
– the Czech Government, by M. Smolek and J. Vláčil, acting as Agents,
– the Italian Government, by G. Palmieri, acting as Agent, and by P. Gentili, avvocato dello Stato,
– the European Commission, by P. Aalto, H. Kranenborg and D. Nardi, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 1 February 2018,
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Article 2(c) and (d) and Article 3 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) read in the light of Article 10 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
2 The request has been made in proceedings brought by the tietosuojavaltuutettu (Data Protection Supervisor, Finland) concerning the legality of a decision of the tietosuojalautakunta (Data Protection Board, Finland) prohibiting the Jehovan todistajat — uskonnollinen yhdyskunta (Jehovah’s Witnesses religious community, ‘the Jehovah’s Witnesses Community’) from collecting or processing personal data in the course of their door-to-door preaching unless the requirements of Finnish legislation relating to the processing of personal data are observed.
Legal context
European Union law
3 Recitals 10, 12, 15, 26 and 27 of Directive 95/46 state:
‘(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms[, signed in Rome on 4 November 1950,] and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
…
(12) Whereas the protection principles must apply to all processing of personal data by any person whose activities are governed by Community law; whereas there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses;
…
(15) Whereas the processing of such data is covered by this Directive only if it is automated or if the data processed are contained or are intended to be contained in a filing system structured according to specific criteria relating to individuals, so as to permit easy access to the personal data in question;
…
(26) Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; …
(27) Whereas the protection of individuals must apply as much to automatic processing of data as to manual processing; whereas the scope of this protection must not in effect depend on the techniques used, otherwise this would create a serious risk of circumvention; whereas, nonetheless, as regards manual processing, this Directive covers only filing systems, not unstructured files; whereas, in particular, the content of a filing system must be structured according to specific criteria relating to individuals allowing easy access to the personal data; whereas, in line with the definition in Article 2(c), the different criteria for determining the constituents of a structured set of personal data, and the different criteria governing access to such a set, may be laid down by each Member State; whereas files or sets of files as well as their cover pages, which are not structured according to specific criteria, shall under no circumstances fall within the scope of this Directive’.
4 Article 1(1) of Directive 95/46 provides:
‘In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.’
5 Article 2 of that directive provides:
‘For the purpose of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c) “personal data filing system” (“filing system”) shall mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
…’
6 Article 3 of the directive states:
‘1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Directive shall not apply to the processing of personal data:
– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
– by a natural person in the course of a purely personal or household activity.’
Finnish law
7 Directive 95/46 was transposed into Finnish law by the henkilötietolaki 523/1999 (Law on personal data No 523/1999, ‘Law No 523/1999’).
8 Paragraph 2, first and second paragraphs, of that law, entitled ‘Soveltamisala’ (Scope), provides;
‘This Law applies to the automated processing of personal data. It also applies to other means of personal data processing where the personal data form part of a personal data filing system or a part of such a system or are intended to form part of a personal data filing system or a part of such a system.
This Law does not apply to the processing of personal data by a natural person for purely personal purposes or for comparable ordinary and private purposes.’
9 Paragraph 3(3) of Law No 523/1999 defines a ‘personal data filing system’ as a ‘set of personal data, connected by a common use and processed fully or partially by automated means or organised using data sheets or lists or any other comparable means permitting the retrieval of data relating to persons easily and without excessive cost’.
10 In accordance with Paragraph 44 of that law, at the request of the Data Protection Supervisor, the Data Protection Board may prohibit processing of personal data that is contrary to that law or to the rules and regulations issued on the basis thereof, and order the parties concerned to remedy the unlawful conduct or negligence within a prescribed period.
The dispute in the main proceedings and the questions referred for a preliminary ruling
11 On 17 September 2013, at the request of the Data Protection Supervisor the Finnish Data Protection Board adopted a decision prohibiting the Jehovah’s Witnesses Community from collecting or processing personal data in the course of door-to-door preaching carried out by its members unless the legal requirements for processing such data laid down, in particular, in Paragraphs 8 and 12 of the Law No 523/1999 were satisfied. Furthermore, on the basis of Paragraph 44(2) of that law, the Data Protection Board imposed a ban on the collection of personal data by the Jehovah’s Witnesses Community for the purposes of that community for a period of six months unless those conditions were observed.
12 In the grounds for its decision, the Data Protection Board considered that the collection of the data at issue by members of the Jehovah’s Witnesses Community constituted processing of personal data within the meaning of that law, and that the Jehovah’s Witnesses Community and its members were both data controllers.
13 The Jehovah’s Witnesses Community brought an action before the Helsingin hallinto-oikeus (Administrative Court, Helsinki, Finland) against that decision. By judgment of 18 December 2014, that court annulled the decision on the ground, inter alia, that the Jehovah’s Witnesses Community was not a controller of personal data within the meaning of Law No 523/1999 and that its activity did not constitute unlawful processing of such data.
14 The Data Protection Supervisor challenged that judgment before the Korkein hallinto-oikeus (Supreme Administrative Court, Finland).
15 According to the findings of that court, the members of the Jehovah’s Witnesses Community take notes in the course of their door-to-door preaching about visits to persons who are unknown to themselves or that Community. The data collected may consist, among other things, of the name and addresses of persons contacted, together with information concerning their religious beliefs and their family circumstances. Those data are collected as a memory aid and in order to be retrieved for any subsequent visit without the knowledge or consent of the persons concerned.
16 The referring court also found that the Jehovah’s Witnesses Community has given its members guidelines on the taking of such notes which appear in at least one of its magazines which is dedicated to preaching. That community and its congregations organise and coordinate the door-to-door preaching by their members, in particular by creating maps from which areas are allocated between the members who engage in preaching and by keeping records about preachers and the number of the Community’s publications distributed by them. Furthermore, the congregations of the Jehovah’s Witnesses Community maintain a list of persons who have requested not to receive visits from preachers and the personal data on that list, called the ‘refusal register’, are used by members of that community. Lastly, the Jehovah’s Witnesses Community has, in the past, made forms available to its members for the purpose of collecting those data in the course of their preaching. However, the use of those forms was abandoned following a recommendation by the Data Protection Supervisor.
17 The referring court observes that, according to information from the Jehovah’s Witnesses Community, it does not require members who engage in preaching to collect data, and that in cases in which such data has been collected it has no knowledge of either the nature of the notes taken which are, moreover, only informal personal notes nor of the identity of the preachers who collected those data.
18 As regards the need for the present request for a preliminary ruling, the Korkein hallinto-oikeus (Supreme Administrative Court) takes the view that the examination of the case in the main proceedings requires consideration to be given, on one hand, to the rights to privacy and protection of personal data and, on the other, to freedom of religion and association guaranteed by the Charter and the European Convention for the Protection of Human Rights and Fundamental Freedoms as well as the Finnish Constitution.
19 The referring court considers that the door-to-door preaching practised by members of a religious community, such as the Jehovah’s Witnesses Community, is not one of the activities excluded from the scope of Directive 95/46, by virtue of the first indent of Article 3(2) thereof. However, the question arises as to whether that activity is a purely personal or household activity within the meaning of the second indent of Article 3(2). In that regard, account must be taken of the fact that, in the present case, the data collected are more than informal notes in an address book, as the notes taken concern unknown persons and contain sensitive data relating to their religious beliefs. The fact that door-to-door preaching is an essential part of the Jehovah’s Witnesses Community’s activity, which is organised and coordinated by it and by its congregations, must also be taken into consideration.
20 Furthermore, since the collected data at issue in the main proceedings are processed otherwise than by automatic means, it must be determined, having regard to Article 3(1) of Directive 95/46 read together with Article 2(c) thereof, whether that set of data constitutes a filing system within the meaning of those provisions. According to the information provided by the Jehovah’s Witnesses Community, those data are not shared, so that it is impossible to know with certainty the nature and extent of the data collected. However, it may be assumed that the purpose of collecting and subsequent processing of the data at issue in the main proceedings is for the easy retrieval of that data concerning a specific person or address for the purposes of a subsequent visit. The data collected are not, however, structured in the form of data sheets.
21 If the data processing at issue in the main proceedings falls within the scope of Directive 95/46, the referring court notes that the question then arises as to whether the Jehovah’s Witnesses Community must be regarded as a controller of that processing within the meaning of Article 2(d) thereof. The case-law of the Court deriving from the judgment of 13 May 2014, Google Spain and Google (C-131/12, EU:C:2014:317), broadly defines the concept of ‘controller’ within the meaning of those provisions. Furthermore, it is clear from Opinion 1/2010 of 16 February 2010 on the concepts of ‘controller’ and ‘processor’ produced by the Working Group set up pursuant to Article 29 of Directive 95/46, that, in particular, the ‘effective control’ and the conception that the data subject has of the controller must be taken into account.
22 In the present case, regard should be had to the fact that the Jehovah’s Witnesses Community organises, coordinates and encourages door-to-door preaching, and that in its publications it has given guidelines on the collection of data in the course of that activity. Furthermore, the Data Protection Supervisor found that that community has effective control over the means of data processing and the power to prohibit or limit that processing, and that it previously defined the purpose and means of data collection by giving guidelines on collection. Furthermore, the forms previously used are also evidence of the active involvement of that community in data processing.
23 However, account should also be taken of the fact that the members of the Jehovah’s Witnesses Community can decide themselves whether to collect data and to determine the means of doing so. Furthermore, that community does not itself collect data and does not have access to the data collected by its members, except that on the ‘refusal’ list. However, such circumstances do not preclude the potential for several data controllers, each with different roles and responsibilities.
24 In those circumstances the Korkein hallinto-oikeus (Supreme Administrative Court) decided to stay the proceedings before it and to refer the following questions to the Court for a preliminary ruling:
‘(1) Must the exceptions to the scope of [Directive 95/46] laid down in Article 3(2), first and second indents, thereof be interpreted as meaning that the collection and other processing of personal data carried out by the members of a religious community in connection with door-to-door preaching fall outside the scope of that directive? When assessing the applicability of [Directive 95/46], what significance is to be given, on one hand, to the fact that it is the religious community and its congregations which organise the preaching activity in the course of which the data is collected and, on the other, to the fact this also concerns the personal religious practice of the members of a religious community?
(2) Must the definition of a “filing system” in Article 2(c) of … Directive [95/46], examined in the light of recitals 26 and 27 of that directive, be interpreted as meaning that, taken as a whole, the personal data (consisting of names and addresses and other information about and characteristics of a person) collected otherwise than by automatic means in connection with the door-to-door preaching described above
(a) does not constitute such a filing system, because the data does not include specific lists or data sheets or any other comparable search method as provided for in the definition laid down in the [Law No 523/1999], or
(b) does constitute such a filing system, because, taking account of its intended purpose, the information required for later use may in practice be searched easily and without unreasonable expense in accordance with [Law No 523/1999]?
(3) Must the phrase “alone or jointly with others determines the purposes and means of the processing of personal data” appearing in Article 2(d) of … Directive [95/46] be interpreted as meaning that a religious community that organises an activity in the course of which personal data is collected (in particular, by allocating areas in which the activity is carried out among the various preachers, supervising the activity of those preachers and keeping a list of individuals who do not wish the preachers to visit them) may be regarded as a controller, in respect of the processing of personal data carried out by its members, even if the religious community claims that only the individual members who engage in preaching have access to the data that they gather?
(4) Must Article 2(d) of Directive [95/46] be interpreted to the effect that in order for a religious community to be considered a controller it must have taken other specific measures, such as giving written instructions or orders directing the collection of data, or is it sufficient that that religious community can be regarded as having de facto control of its members’ activities?
It is necessary to answer Questions 3 and 4 only if, on the basis of the answers to Questions 1 and 2, [Directive 95/46] is applicable. It is necessary to answer Question 4 only if, on the basis of Question 3, the application of Article 2(d) of [Directive 95/46] to the Community cannot be regarded as being excluded.’
The request to have the oral procedure reopened
25 By two documents lodged at the Court Registry on 12 December 2017 and 15 February 2018 respectively, the Jehovah’s Witnesses Community requested the Court to order the reopening of the oral part of the procedure pursuant to Article 83 of the Rules of Procedure of the Court. In support of the first of those requests, the Jehovah’s Witnesses Community claims, in particular, that it did not have the opportunity at the hearing to respond to the observations submitted by the other parties, some of which did not reflect the facts in the main proceedings. As regards the second request, the Jehovah’s Witnesses Community argues essentially that the Opinion of the Advocate General is based on inaccurate or potentially misleading facts, some of which are not mentioned in the request for a preliminary ruling.
26 Pursuant to Article 83 of its Rules of Procedure, the Court may at any time, after hearing the Advocate General, order the reopening of the oral part of the procedure, in particular if it considers that it lacks sufficient information or where a party has, after the close of that part of the procedure, submitted a new fact which is of such a nature as to have a decisive bearing on the decision of the Court, or where the case must be decided on the basis of an argument which has not been debated between the parties or the interested persons referred to in Article 23 of the Statute of the Court of Justice of the European Union.
27 That is not the case here. In particular, the requests of the Jehovah’s Witnesses Community seeking to have the oral procedure reopened do not contain any new argument on the basis of which the present case should be decided. Furthermore, that party and the other interested parties referred to in Article 23 of the Statute of the Court of Justice of the European Union submitted, both during the written phase and the oral phase of the proceedings, their observations concerning the interpretation of Article 2(c) and (d), and Article 3 of Directive 95/46, read in the light of Article 10 of the Charter, which is the subject of the questions referred for a preliminary ruling.
28 As regards the facts in the main proceedings, it must be recalled that in proceedings under Article 267 TFEU, only the court making the reference may define the factual context in which the questions which it asks arise or, at very least, explain the factual assumptions on which the questions are based. It follows that a party to the main proceedings cannot allege that certain factual premisses on which the arguments advanced by the other interested parties referred to in Article 23 of the Statute of the Court of Justice of the European Union are based, or the analysis of the Advocate General, are incorrect in order to justify the reopening of the oral procedure, on the basis of Article 83 of the Rules of Procedure (see, to that effect, judgment of 26 June 2008, Burda, C-284/06, EU:C:2008:365, paragraphs 44, 45 and 47).
29 Against that background, the Court, having heard the Advocate General, considers that it has all the evidence necessary to enable it to reply to the questions referred and that the present case does not thereby fall to be decided on the basis of an argument which has not been debated between the parties. The request to reopen the oral procedure must therefore be rejected.
Admissibility of the request for a preliminary ruling
30 The Jehovah’s Witnesses Community claims that the request for a preliminary ruling is inadmissible. While challenging the main facts on which that request is based, it claims that the request for a preliminary ruling relates to the conduct of some of its members who are not parties to the main proceedings. Therefore, that request concerns a hypothetical problem.
31 In that connection, it is solely for the national court hearing the case, which has the responsibility of taking the subsequent judicial decision, to determine, with regard to the particular aspects of the case, both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it refers to the Court. Consequently, where the questions put by national courts concern the interpretation of a provision of European Union law, the Court is, in principle, bound to give a ruling. The Court may refuse to rule on a question referred by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (see, to that effect, judgment of 27 June 2017, Congregación de Escuelas Pías Provincia Betania, C-74/16, EU:C:2017:496, paragraphs 24 and 25 and the case-law cited).
32 In the present case, the order for reference contains sufficient factual and legal information to understand both the questions referred for a preliminary ruling and their scope. Further, and most importantly, nothing in the file leads to the conclusion that the interpretation requested of EU law is unrelated to the actual facts of the main action or its object, or that the problem is hypothetical, in particular on account of the fact that the members of the Jehovah’s Witnesses Community whose collection of personal data is the basis for the questions referred are not parties to the main proceedings. It is clear from the order for reference that the questions referred are intended to assist the referring court to determine whether that community may itself be regarded as a controller, within the meaning of Directive 95/46, in connection with the collection of the personal data by its members in the course of their door-to-door preaching activities.
33 The reference for a preliminary ruling is therefore admissible.
Consideration of the questions referred
The first question
34 By its first question, the referring court asks essentially whether Article 3(2) of Directive 95/46, read in the light of Article 10(1) of the Charter, must be interpreted as meaning that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data constitutes the processing of personal data carried out for the purposes of the activities referred to in Article 3(2), first indent, of that directive or the processing of personal data carried out by a natural person in the course of a purely personal or household activity within the meaning of Article 3(2), second indent, thereof.
35 In order to answer that question, it should be observed from the outset, as is clear from Article 1(1) and recital 10 of Directive 95/46, that that directive seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 66, and of 5 June 2018, Wirtshaftsakademie Schleswig-Holstein, C-210/16, EU:C:2018:388, paragraph 26).
36 Article 3 of Directive 95/46, which defines the scope of the directive, states in paragraph 1 that its provisions ‘shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system’.
37 However, Article 3(2) lays down two exceptions to the scope of application of that directive which must be strictly interpreted (see, to that effect, judgments of 11 December 2014, Ryneš, C-212/13, EU:C:2014:2428, paragraph 29, and of 27 September 2017, Puškár, C-73/16, EU:C:2017:725, paragraph 38). Furthermore, Directive 95/46 does not lay down any further limitation of its scope (judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, paragraph 46).
38 First, as regards the exception in Article 3(2), first indent, of Directive 95/46, it has been held that the activities mentioned therein by way of exceptions are, in any event, activities of the State or of State authorities and are unrelated to fields in which individuals are active. Those activities are intended to define the scope of the exception provided for in that provision, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category (judgments of 6 November 2003, Lindqist, C-101/01, EU:C:2003:596, paragraphs 43 and 44; of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, paragraph 41; and of 27 September 2017, Puškár, C-73/16, EU:C:2017:725, paragraphs 36 and 37).
39 In the present case, the collection of personal data by members of the Jehovah’s Witnesses Community in the course of door-to-door preaching is a religious procedure carried out by individuals. It follows that such activity is not an activity of the State authorities and cannot therefore be treated in the same way as the activities referred to in Article 3(2), first indent, of Directive 95/46.
40 Second, as regards the exception in Article 3(2), second indent, of Directive 95/46, that provision does not exclude from its scope data processing carried out in relation simply to an activity which is simply a personal or household activity, but only data processing carried out in relation to an activity that is ‘purely’ personal or household in nature (see, to that effect, judgment of 11 December 2014, Ryneš, C-212/13, EU:C:2014:2428, paragraphs 30).
41 The words ‘personal or household’, within the meaning of that provision, refer to the activity of the person processing the personal data and not to the person whose data are processed (see, to that effect, judgment of 11 December 2014, Ryneš, C-212/13, EU:C:2014:2428, paragraphs 31 and 33).
42 As the Court held, Article 3(2), second indent, of Directive 95/46 must be interpreted as covering only activities that are carried out in the context of the private or family life of individuals. In that connection, an activity cannot be regarded as being purely personal or domestic where its purpose is to make the data collected accessible to an unrestricted number of people or where that activity extends,even partially, to a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner (see, to that effect, judgments of 6 November 2003, Lindqvist, C-101/01, EU:C:2003:596, paragraph 47; of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008:727, paragraph 44; and of 11 December 2014, Ryneš, C-212/13, EU:C:2014:2428, paragraphs 31 and 33).
43 In so far as it appears that the personal data processing at issue in the main proceedings is carried out in the course of door-to-door preaching by members of the Jehovah’s Witnesses Community, it must be determined whether such an activity is a purely personal or household activity within the meaning of Article 3(2), second indent, of Directive 95/46.
44 In that connection, it is clear from the order for reference that door-to-door preaching, in the course of which personal data are collected by members of the Jehovah’s Witnesses Community, is, by its very nature, intended to spread the faith of the Jehovah’s Witnesses Community among people who, as the Advocate General observed in point 40 of his Opinion, do not belong to the faith of the members who engage in preaching. Therefore, that activity is directed outwards from the private setting of the members who engage in preaching.
45 Furthermore, it is also clear from the order for reference that some of the data collected by the members of that community who engage in preaching are sent by them to the congregations of that community which compile lists from that data of persons who no longer wish to receive visits from those members. Thus, in the course of their preaching, those members make at least some of the data collected accessible to a potentially unlimited number of persons.
46 As to whether the fact that the processing of personal data is carried out in the course of an activity relating to a religious practice may confer a purely personal or household nature on that door-to-door preaching, it must be recalled that the right to freedom of conscience and religion, enshrined in Article 10(1) of the Charter, implies, in particular, the freedom for everyone to manifest his religion or belief, in worship, teaching, practice and observance.
47 The Charter adopts a broad understanding of the concept of ‘religion’ in that provision covering both the forum internum, that is the fact of having a belief, and the forum externum, that is the manifestation of religious faith in public (judgment of 29 May 2018, Liga van Moskeeën en Islamitische Organisaties Provincie Antwerpen VZW and Others, C-426/16, EU:C:2018:335, paragraph 44 and the case-law cited).
48 Furthermore, the freedom to manifest one’s religion individually or collectively in public or in private, since it may take various forms such as the teaching, practice and performance of rites, includes also the right to attempt to convince other persons, for example by means of preaching (ECtHR, 25 May 1993, Kokkinakisv. Greece, EC:ECHR:1993:0525JUD001430788, § 31, and ECtHR, 8 November 2007, Perry v. Latvia, CE:ECHR:2007:1108JUD003027303, § 52).
49 However, although the door-to-door preaching activities of the member of a religious community is thereby protected by Article 10(1) of the Charter as an expression of the faith of those preachers, that fact does not confer an exclusively personal or household character on that activity, within the meaning of Article 3(2), second indent, of Directive 95/46.
50 Taking account of the considerations set out in paragraphs 44 and 45 of the present judgment, the preaching extends beyond the private sphere of a member of a religious community who is a preacher.
51 Having regard to the foregoing considerations, the answer to Question 1 is that Article 3(2) of Directive 95/46, read in the light of Article 10(1) of the Charter, must be interpreted as meaning that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data does not constitute either the processing of personal data for the purpose of activities referred to in Article 3(2), first indent, of that directive or the processing of personal data carried out by a natural person in the course of a purely personal or household activity, within the meaning of Article 3(2), second indent, thereof.
The second question
52 By its second question, the referring court asks essentially whether Article 2(c) of Directive 95/46 must be interpreted as meaning that the concept of a ‘filing system’ referred to in that provision covers a set of personal data collected in the course of door-to-door preaching, consisting of names and addresses as well as other information concerning persons contacted, if those data may, in practice, be easily retrieved for later use, or whether, in order to be covered by that definition, that set of data must include data sheets, specific lists or other search methods.
53 As is clear from Article 3(1) and recitals 15 and 27 of Directive 95/46, that directive covers both automatic processing of data and the manual processing of such data, so that the scope of the protection it confers on data subjects does not depend on the techniques used and avoids the risk of that protection being circumvented. However, it is also clear that that directive applies to the manual processing of personal data only where the data processed form part of a filing system or are intended to form part of a filing system.
54 In the present case, since the processing of the personal data at issue in the main proceedings is carried out otherwise than by automatic means, the question arises as to whether the data processed form part of or are intended to form part of a filing system within the meaning of Article 2(c) and Article 3(1) of Directive 95/46.
55 In that connection, it is stipulated in Article 2(c) of Directive 95/46 that the concept of a ‘filing system’ is ‘any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis’.
56 In accordance with the objective set out in paragraph 53 of the present judgment, that provision broadly defines the concept of ‘filing system’, in particular by referring to ‘any’ structured set of personal data.
57 As is clear from recitals 15 and 27 of Directive 95/46, the content of a filing system must be structured in order to allow easy access to personal data. Furthermore, although Article 2(c) of that directive does not set out the criteria according to which that filing system must be structured, it is clear from those recitals that those criteria must be ‘relat[ed] to individuals’. Therefore, it appears that the requirement that the set of personal data must be ‘structured according to specific criteria’ is simply intended to enable personal data to be easily retrieved.
58 Apart from that requirement, Article 2(c) of Directive 95/46 does not lay down the practical means by which a filing system is be structured or the form in which it is to be presented. In particular, it does not follow from that provision, or from any other provision of that directive, that the personal data at issue must be contained in data sheets or specific lists or in another search method, in order to establish the existence of a filing system within the meaning of that directive.
59 In the present case, it is clear from the findings of the referring court that the data collected in the course of the door-to-door preaching at issue in the main proceedings are collected as a memory aid, on the basis of an allocation by geographical sector, in order to facilitate the organisation of subsequent visits to persons who have already been contacted. They include not only information relating to the content of conversations concerning the beliefs of the person contacted, but also his name and address. Furthermore, those data, or at least a part of them, are used to draw up lists kept by the congregations of the Jehovah’s Witnesses Community of persons who no longer wish to receive visits by members who engage in the preaching of that community.
60 Thus, it appears that the personal data collected in the course of the door-to-door preaching at issue in the main proceedings are structured according to criteria chosen in accordance with the objective pursued by that collection, which is to prepare for subsequent visits and to keep lists of persons who no longer wish to be contacted. Thus, as it is apparent from the order for reference, those criteria, among which are the name and address of persons contacted, their beliefs or their wish not to receive further visits, are chosen so that they enable data relating to specific persons to be easily retrieved.
61 In that connection, the specific criterion and the specific form in which the set of personal data collected by each of the members who engage in preaching is actually structured is irrelevant, so long as that set of data makes it possible for the data relating to a specific person who has been contacted to be easily retrieved, which is however for the referring court to ascertain in the light of all the circumstances of the case in the main proceedings.
62 Therefore, the answer to Question 2 is that Article 2(c) of Directive 95/46 must be interpreted as meaning that the concept of a ‘filing system’, referred to by that provision, covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use. In order for such a set of data to fall within that concept, it is not necessary that they include data sheets, specific lists or other search methods.
The third and fourth questions
63 By Questions 3 and 4, which it is appropriate to examine together, the referring court asks essentially whether Article 2(d) of Directive 95/46, read in the light of Article 10(1) of the Charter, must be interpreted as meaning that a religious community may be regarded as a controller, jointly with its members who engage in preaching, with regard to the processing of personal data carried out by the latter in the context of door-to-door preaching organised, coordinated and encouraged by that community, and whether it is necessary for that purpose for the community to have access to those data, or whether it must be established that the religious community has given its members written guidelines or instructions in relation to that processing.
64 In the present case, the Data Protection Board, in the decision at issue in the main proceedings, found that the Jehovah’s Witnesses Community is a controller, jointly with its members who engage in preaching, of the processing of personal data carried out by the latter in the context of door-to-door preaching. In so far as only the responsibility of that community is challenged, the responsibility of the members who engage in preaching does not appear to be called into question.
65 As expressly provided in Article 2(d) of Directive 95/46, the concept of ‘controller’ refers to the natural or legal person who ‘alone or jointly with others determines the purposes and means of the processing of personal data’. Therefore, that concept does not necessarily refer to a single natural or legal person and may concern several actors taking part in that processing, with each of them then being subject to the applicable data protection provisions (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16, EU:C:2018:388, paragraph 29).
66 The objective of that provision being to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of the persons concerned, the existence of joint responsibility does not necessarily imply equal responsibility of the various operators engaged in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, so that the level of responsibility of each of them must be assessed with regard to all the relevant circumstances of the particular case (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16, EU:C:2018:388, paragraphs 28, 43 and 44).
67 In that connection, neither the wording of Article 2(d) of Directive 95/46 nor any other provision of that directive supports a finding that the determination of the purpose and means of processing must be carried out by the use of written guidelines or instructions from the controller.
68 However, a natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller within the meaning of Article 2(d) of Directive 95/46.
69 Furthermore, the joint responsibility of several actors for the same processing, under that provision, does not require each of them to have access to the personal data concerned (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16, EU:C:2018:388, paragraph 38).
70 In the present case, as is clear from the order for reference, it is true that members of the Jehovah’s Witnesses Community who engage in preaching determine in which specific circumstances they collect personal data relating to persons visited, which specific data are collected and how those data are subsequently processed. However, as set out in paragraphs 43 and 44 of the present judgment, the collection of personal data is carried out in the course of door-to-door preaching, by which members of the Jehovah’s Witnesses Community who engage in preaching spread the faith of their community. That preaching activity is, as is apparent from the order for reference, organised, coordinated and encouraged by that community. In that context, the data are collected as a memory aid for later use and for a possible subsequent visit. Finally, the congregations of the Jehovah’s Witnesses Community keep lists of persons who no longer wish to receive a visit, from those data which are transmitted to them by members who engage in preaching.
71 Thus, it appears that the collection of personal data relating to persons contacted and their subsequent processing help to achieve the objective of the Jehovah’s Witnesses Community, which is to spread its faith and are, therefore, carried out by members who engage in preaching for the purposes of that community. Furthermore, not only does the Jehovah’s Witnesses Community have knowledge on a general level of the fact that such processing is carried out in order to spread its faith, but that community organises and coordinates the preaching activities of its members, in particular, by allocating areas of activity between the various members who engage in preaching.
72 Such circumstances lead to the conclusion that the Jehovah’s Witnesses Community encourages its members who engage in preaching to carry out data processing in the context of their preaching activity.
73 In the light of the file submitted to the Court, it appears that the Jehovah’s Witnesses Community, by organising, coordinating and encouraging the preaching activities of its members intended to spread its faith, participates, jointly with its members who engage in preaching, in determining the purposes and means of processing of personal data of the persons contacted, which is, however, for the referring court to verify with regard to all of the circumstances of the case.
74 That finding cannot be called into question by the principle of organisational autonomy of religious communities which derives from Article 17 TFEU. The obligation for every person to comply with the rules of EU law on the protection of personal data cannot be regarded as an interference in the organisational autonomy of those communities (see, to that effect, judgment of 17 April 2018, Egenberger, C-414/16, EU:C:2018:257, paragraph 58).
75 Having regard to the foregoing considerations, the answer to Questions 3 and 4 is that Article 2(d) of Directive 95/46, read in the light of Article 10(1) of the Charter, must be interpreted as meaning that it supports the finding that a religious community is a controller, jointly with its members who engage in preaching, of the processing of personal data carried out by the latter in the context of door-to-door preaching organised, coordinated and encouraged by that community, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing.
Costs
76 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 3(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, read in the light of Article 10(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data does not constitute either the processing of personal data for the purpose of activities referred to in Article 3(2), first indent, of that directive or the processing of personal data carried out by a natural person in the course of a purely personal or household activity, within the meaning of Article 3(2), second indent, thereof.
2. Article 2(c) of Directive 95/46 must be interpreted as meaning that the concept of a ‘filing system’, referred to by that provision, covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use. In order for such a set of data to fall within that concept, it is not necessary that they include data sheets, specific lists or other search methods.
3. Article 2(d) of Directive 95/46, read in the light of Article 10(1) of the Charter of Fundamental Rights, must be interpreted as meaning that it supports the finding that a religious community is a controller, jointly with its members who engage in preaching, for the processing of personal data carried out by the latter in the context of door-to-door preaching organised, coordinated and encouraged by that community, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing.
[Signatures]
* Language of the case: Finnish.
Disclaimer