C-101/01

OPINION OF MR TIZZANO — CASE C-101/01

OPINION OF ADVOCATE GENERAL TIZZANO delivered on 19 September 2002 1

1. By order of 23 February 2001, the The legal framework Hovrätten di Götaland (Göta Court of Appeal, Sweden) referred seven questions to the Court for a preliminary ruling on the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of The European Convention for the Protec- individuals with regard to the processing tion of Human Rights and Fundamental of personal data and on the free movement Freedoms of such data (hereinafter referred to as 'Directive 95/46' or simply 'the Direc- tive'). 2 The questions concern, in particu- lar, the scope of the Directive, the transfer 2. In order to establish the legal back- of personal data to third countries, whether ground to the present case, it is essential the Directive is compatible with the general first to consider Articles 8 and 10 of the principles of freedom of expression and European Convention for the Protection of whether national rules may be introduced Human Rights and Fundamental Free- that are more restrictive than the Commu- doms. nity provisions.

3. Article 8 provides, in particular:

'1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a 1 — Original language: Italian. public authority with the exercise of this 2 — OJ 1995 L 281, p. 31. right except such as is in accordance with

' 1 . Everyone has the right to freedom of expression. This right shall include freedom 6. The Directive is based on the idea that to hold opinions and to receive and impart 'the difference in levels of protection of the information and ideas without interference rights and freedoms of individuals, notably by public authority and regardless of fron- the right to privacy, with regard to the tiers. This article shall not prevent States processing of personal data afforded in the from requiring the licensing of broadcast- Member States may prevent the trans- ing, television or cinema enterprises. mission of such data from the territory of one Member State to that of another Member State [and that] this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge of 2. The exercise of these freedoms, since it their responsibilities under Community carries with it duties and responsibilities, law' (seventh recital in the preamble). The may be subject to such formalities, con- C o m m u n i t y legislature therefore con- ditions, restrictions or penalties as are sidered that 'in order to remove the prescribed by law and are necessary in a obstacles to flows of personal data, the democratic society, in the interests of level of protection of the rights and free- national security, territorial integrity or doms of individuals with regard to the public safety, for the prevention of disorder processing of such data must be equivalent or crime, for the protection of health or in all Member States'. To that end, it morals, for the protection of the reputation considered that a harmonisation measure at or rights of others, for preventing the Community level was needed inasmuch as disclosure of information received in con- the objective of free movement of personal fidence, or for maintaining the authority data, 'is vital to the internal market but and impartiality of the judiciary'. cannot be achieved by the Member States

2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons con- nected with the protection afforded under paragraph 1'. 7. That being said, the Community legis- lature took the view that in determining a level of protection 'equivalent in all Member States' it was essential to take account of the requirement that 'the fun- 9. As regards the principal definitions set damental rights of individuals' should be out in Article 2 of the Directive, it should safeguarded (third recital). In that light, it be borne in mind for present purposes that: considered in particular that 'the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in (a) 'personal data' means 'any information Article 8 of the European Convention for relating to an identified or identifiable the Protection of Human Rights and Fun- natural person ("data subject"); an damental Freedoms and in the general identifiable person is one who can be principles of Community law'. For that identified, directly or indirectly, in reason, it considered that 'the approxi- particular by reference to an identifi¬

I - 12978

LINDQVIST

cation number or to one or more 10. Article 3 defines the scope of the factors specific to his physical, physio- Directive, specifying in paragraph 1 that it logical, mental, economic, cultural or is to apply 'to the processing of personal social identity'; data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system'. Paragraph 2 provides that it is not to apply to the processing of personal data:

11. For present purposes, some of the 'Member States shall provide for exemp- provisions of Chapter II of the Directive tions or derogations from the provisions of ('General rules on the lawfulness of the this Chapter, Chapter IV and Chapter VI processing of personal data', Articles 5-21), for the processing of personal data carried are also important, notably Article 7, out solely for journalistic purposes or the which concerns the cases in which 'per- purpose of artistic or literary expression sonal data may be processed'. In that only if they are necessary to reconcile the connection, it should be pointed out in right to privacy with the rules governing particular that Article 7(a) provides that, as freedom of expression'. in other instances of no relevance to the present case, such data may be processed only if 'the data subject has unambiguously given his consent'.

I - 12980

LINDQVIST

of law, both general and sectoral, in force course of her work, to enable the parish- in the third country in question and the ioners to obtain easily the information they professional rules and security measures needed, Mrs Lindqvist set up a home page which are complied with in that country' on the Internet with information about (paragraph 2). herself, her husband and 16 colleagues in the parish, giving only their first name in some cases and their full name in others. In addition, the home page described, in a mildly humorous manner, her colleagues' jobs and hobbies; and in some cases their family circumstances were outlined, and The relevant Swedish provisions telephone numbers and other personal information given. One of the various items of interest for present purposes was a report that a colleague was on half-time 16. Sweden implemented Directive 95/46 on medical grounds because she had by means of the Personuppgiftslagen (law injured her foot. The home page was also on personal data). 4For present purposes, it accessible through the Swedish Church's is noteworthy that, under Section 49(1)(b) home page, with which a link had been set to (d) of that law, the following offences up at Mrs Lindqvist's request. are subject to prosecution in Sweden: failure to notify the competent supervisory authority (the Datainspektionen) of any processing of personal data by automatic means; processing sensitive data, including data relating to health; and transferring processed personal data to a third country without authorisation. It is also clear from 18. Mrs Lindqvist had not told her col- the travaux préparatoires for the Person- leagues about the home page or sought uppgiftslagen that that law is not intended their consent to process their data. The to differ in scope from the Directive. Datainspektionen had not been informed that the home page was being set up, nor had it been notified of any processing of personal data. The home page was short- lived, however, as Mrs Lindqvist quickly took steps to remove it as soon as she became aware that some of her colleagues Facts and procedure were unhappy about it.

If the answer to either of those questions is yes, the Hovrätten also asks the following questions:

2 1 . As doubts arose in the course of the proceedings as to whether the Swedish legislation was consistent with the provi- sions of the Directive and complex issues were raised regarding the interpretation of those provisions, the Hovrätten stayed proceedings in order to refer the following (3) Can the act of loading information of questions to the Court of Justice for a the type described about work col- preliminary ruling: leagues onto a private home page

I - 12982

LINDQVIST

which is none the less accessible to (6) Can the provisions of the Directive, in anyone who knows its address be a case such as the above, be regarded as regarded as outside the scope of the bringing about a restriction which directive on the ground that it is conflicts with the general principles of covered by one of the exceptions in freedom of expression or other free- Article 3(2)? doms and rights, which are applicable within the EU and are enshrined in inter alia Article 10 of the European Convention for the Protection of Human Rights and Fundamental Free- doms?

(4) Is information on a home page stating that a named colleague has injured her foot and is on half-time on medical Lastly, the Hovrätten wishes to ask the grounds personal data concerning following question: health which, according to Article 8(1), may not be processed?

Legal analysis — second, loading that information on a home page of the type at issue gives rise to a 'processing' of personal data since, in that respect too, the Directive con- tains a particularly wide definition covering 'any operation or set of operations which is performed upon personal data, whether or not by Introduction automatic means such as collection, recording, organisation, storage, adap- tation or alteration, retrieval, consul- tation, use, disclosure by transmission, dissemination or otherwise making 23. As we have seen, the referring court available, alignment or combination, asks the Court a number of questions about b l o c k i n g , e r a s u r e or d e s t r u c t i o n ' the scope of the Directive, the interpre- (Article 2(b)). tation of Articles 8 and 25, the validity of its provisions with reference to general principles of Community law, and whether Member States may provide a higher level of protection than that afforded by the Directive.

24. With reference more specifically to the scope of the Directive, the court appears to have no doubt that there was 'processing of personal data' in the present case, nor did any of the intervening parties express any doubt on the subject. Indeed it is clear that:

25. However, not all 'processing of per- sonal data' falls within the scope of the Directive. Article 3(1) provides that the Directive shall apply only to the processing of personal data 'wholly or partly by — first, the information about automatic means' and to the processing Mrs Lindqvist's colleagues (first name, 'otherwise than by automatic means of surname, telephone number, job, personal data which form part of a filing hobbies, etc.) is 'personal data', given system or are intended to form part of a that 'any information relating to an filing system'. In more general terms, identified or identifiable natural per- Article 3(2) then provides that the Directive s o n ' falls i n t o t h a t c a t e g o r y shall not apply to the processing of per- (Article 2(a)); and sonal data 'in the course of an activity

(ii) whether the processing of personal The third question data of the type at issue is nevertheless outside the scope of the Directive in so far as it is carried out 'in the course of an activity which falls outside the scope of Community law' or 'by a natural Arguments of the parties

5 — By way of example, the provision in question mentions the activities 'provided for by Titles V and VI of the Treaty on European Union', adding that in any case 'processing operations concerning public security, defence, State secur- ity (including the economic well-being of the State when the processing operation relates to State security matters) and 28. All the intervening parties submitted the activities of the State in areas of criminal law' are also excluded. observations on this question, except for

I - 12985

OPINION OF MR TIZZANO — CASE C-101/01

the United Kingdom which confined itself that the dissemination of personal data via to the fifth and sixth questions. the Internet cannot be described as 'a purely personal or household activity' inas- much as it entails the transmission of that data to an indefinite number of people.

I - 12986

LINDQVIST

because, in availing herself of services (in an activity which falls outside the scope of particular telecommunications services) Community law' or 'by a natural person in connected with the use of the Internet, the course of a purely personal or house- Mrs Lindqvist is in its view a 'person for hold activity'. whom... services are intended' 6within the meaning of Article 49 EC. Lastly, the Commission observes that the activity at issue in the present case is not 'a purely personal or household activity' because, in the first place, a home page is accessible not only to anyone who knows its address but to anyone using a search engine and, in the second place, such activities are by defini- tion concerned only with the private life of the person processing the data.

I - 12987

OPINION OF M R T I Z Z A N O — CASE C-101/01

35. On the other hand, I agree with in the case to suggest any cross-border Mrs Lindqvist that the processing in ques- element that could justify the application of tion was carried out 'in the course of an Article 49 in the present case, 7it seems to activity which falls outside the scope of me to be abundantly clear that Article 3(2) Community law'. of the Directive would be completely meaningless if all activities, even non-econ- omic activities, for which people used telecommunications or other services were to be regarded as falling within the scope of Community law. On that premiss, the Directive would also have to be extended to cover the activities 'provided for by 36. In that connection, I note that in fact Titles V and VI of the Treaty on European the home page in question was set up by Union' too, whenever they involve the use Mrs Lindqvist without any intention of of those services, although those activities economic gain, solely as an ancillary activ- are expressly mentioned in Article 3(2) as ity to her voluntary work as a catechist in examples of 'an activity which falls outside the parish community and outside the remit the scope of Community law'. of any employment relationship. The pro- cessing of the personal data in question was therefore carried out in the course of a non-economic activity which had no con- nection (or at least no direct connection) with the exercise of the fundamental free- doms protected by the Treaty and is not governed by any specific rules at Commu- nity level. In my view, it therefore follows that that processing was carried out in the course of an activity which falls outside the scope of Community law within the mean- ing of Article 3(2) of the Directive.

39. In that connection, it should be borne order to ensure a 'high level' of protection in mind that the Directive was adopted on of those rights (tenth recital). However, all the basis of Article 100a of the Treaty to this was conceived in the course of and encourage the free movement of personal with a view to achieving the main objective data through the harmonisation of the of the Directive, namely the free movement laws, regulations and administrative provi- of personal data inasmuch as it is held to be sions of the Member States on the pro- 'vital to the internal m a r k e t ' (eighth tection of individuals with respect to the recital). processing of such data. In particular, the Community legislature wanted to establish a level of protection 'equivalent in all Member States' in order to remove the obstacles to flows of personal data resulting from the 'difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy,... afforded in 4 1 . Contributing to economic and social the Member States' (seventh and eighth progress and safeguarding fundamental recitals) 8 because, once the harmonisation rights therefore represent important values Directive was adopted, 'given the equival- and imperatives which the Community ent protection resulting from the approxi- legislature took into account in framing mation of national laws, the Member States the harmonised rules required for the will no longer be able to inhibit the free establishment and functioning of the inter- movement between them of personal data nal market but they are not independent on grounds relating to protection of the objectives of the Directive. Otherwise, it rights and freedoms of individuals, and in would have to be assumed that the Direc- particular the right to privacy' (ninth tive was intended to protect individuals recital). with respect to the processing of personal data to the point of disregarding the objective of encouraging the free movement of such data, with the absurd consequence that the only processing to fall within its scope would be processing for the purpose of activities which had some social signifi- cance but no connection with the establish- ment and functioning of the internal mar- ket. 40. It is of course true that, in determining the level of protection 'equivalent in all M e m b e r States', the legislature t o o k account of the need to 'contribute to economic and social progress' and (above all) to safeguard 'the fundamental rights of individuals' (second and third recitals) in 42. Also, as Mrs Lindqvist has pointed out, if in addition to the aim of encouraging the free movement of personal data in the 8 — The seventh recital emphasises in particular that this difference may 'constitute an obstacle to the pursuit of a internal market, the Directive were held to number of economic activities at Community level, distort have other, independent, objectives con- competition and impede authorities in the discharge of their responsibilities under Community law'. nected with social imperatives and the

44. In the light of all the foregoing obser- vations, I therefore propose that the answer to this question should be that, pursuant to the first indent of Article 3(2) of the Directive, processing of personal data which consists of setting up a home page of the type at issue without any intention of economic gain, solely as an ancillary activ- ity to voluntary work as a catechist pursued 43. I note in this connection that quite in the parish community and outside the recently, in the well-known judgment remit of any employment relationship does annulling Directive 98/43/EC 9 for lack of not fall within the scope of the Directive. legal basis, the Court had occasion to make it clear on this very point that 'the measures referred to in Article 100a(1) of the Treaty are intended to improve the conditions for the establishment and functioning of the internal market. To construe that article as meaning that it vests in the Community legislature a general power to regulate the internal market would not only be contrary The other questions to the express wording of the provisions cited above but would also be incompatible with the principle embodied in Article 3 b of the EC Treaty (now Article 5 EC) that the powers of the Community are limited to those specifically conferred on it'. 1 0 With 45. Having come to the conclusion that specific reference to the protection of processing of personal data of the type at fundamental rights, I would point out that issue does not fall within the scope of the Directive, I do not think there is any need to examine the other questions put by the 9 — Directive 98/43/EC of the European Parliament and of the referring court. Council of 6 July 1998 on the approximation of the laws, regulations and administrative provisions of the Member States relating to the advertising and sponsorship of tobacco products (OJ 1998 L 213, p. 9). 10 — Judgment in Case C-376/98 Germany v Parliament and 11 — O p i n i o n 2/94 of 28 March 1996 [1996] ECR I-1759, Council [2000] ECR I-2247, paragraph 83. point 27.