Judgment;Summary — ECLI:EU:C:2024:216
Date: 2024-03-07
Language of the case: Finnish
Court formation: Sixth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Finland

Translation C-740/22 – 1 
Case C-740/22 
Request for a preliminary ruling 
Date lodged: 
2 December 2022 
Referring court: 
Itä-Suomen hovioikeus (Finland) 
Date of the decision to refer: 
30 November 2022 
Appellant: 
Endemol Shine Finland Oy 
… 
      
Request for a preliminary ruling of 30 November 2022 
… 
APPELLANT: Endemol Shine Finland Oy (‘the company’) 
SUBJECT MATTER: Requests for information 
Decision of the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland) 
Subject matter of the dispute 
1 This case concerns the interpretation of Articles 2(1) and 4(2) of Regulation (EU) 
2016/679 of the European Parliament and of the Council of 27 April 2016 on the 
protection of natural persons with regard to the processing of personal data and on 
the free movement of such data, and repealing Directive 95/46/EC (General Data 
Protection Regulation). It concerns specifically whether an oral transfer of 
personal data constitutes processing of personal data within the meaning of 
Article 4(2) of the General Data Protection Regulation. In addition, it concerns 
whether public access to official documents can be reconciled with the right to 
protection of personal data pursuant to the General Data Protection Regulation, in 
the manner referred to by Article 86 of the regulation, by allowing information on 
criminal convictions or offences of a natural person to be obtained from a court’s 
EN 
REQUEST FOR A PRELIMINARY RULING OF 30. 11. 2022 – CASE C-740/22 
 
2  
register of persons without restriction where a request is made to transfer the 
information orally to the applicant. 
The relevant facts 
2 The company made an oral request to the Etelä-Savon käräjäoikeus (District 
Court, South Savo) for information on possible ongoing or completed criminal 
proceedings against a natural person. According to that court, the information was 
requested for the purpose of clarifying the criminal record of a person involved in 
a competition. 
Processing of the request for information by the District Court 
3 According to that court, the reason stated by the company for processing the data 
was not a reason for processing criminal convictions or offences referred to in 
Paragraph 7 of Chapter 2 of the Tietosuojalaki (Law on data protection). 
Therefore, the District Court took the view that the data requested by the company 
could not be disclosed to it, notwithstanding the fact that it related to public 
decisions or information under the Laki oikeudenkäynnin julkisuudesta yleisissä 
tuomioistuimissa (Law on the public nature of proceedings before ordinary 
courts). A search of the court’s information systems would also have constituted 
processing of personal data, which is why the requested information could also 
not have been disclosed orally. Likewise, a contractual agreement per se was not a 
sufficient reason for processing criminal convictions or offences. For the above 
reasons, the court refused the company’s request for information. 
4 The company lodged an appeal against the order of the District Court with the 
Court of Appeal, Eastern Finland. In its appeal, it argued inter alia that fulfilment 
of the request for information by providing orally the requested information on 
possible ongoing and completed criminal proceedings did not constitute 
processing of personal data under Article 4(2) of the regulation. The Court of 
Appeal granted the company leave to proceed.  
Legislation applicable 
EU law 
5 Under Article 2(1) of the General Data Protection Regulation, the regulation 
applies to the processing of personal data wholly or partly by automated means 
and to the processing other than by automated means of personal data which form 
part of a filing system or are intended to form part of a filing system. Under 
Article 4(2) of that regulation, for the purposes of the regulation ‘processing’ 
means any operation or set of operations which is performed on personal data or 
on sets of personal data, whether or not by automated means, such as collection, 
ENDEMOL SHINE FINLAND 
 
3 
recording, organisation, structuring, storage, adaptation or alteration, retrieval, 
consultation, use, disclosure by transmission, dissemination or otherwise making 
available, alignment or combination, restriction, erasure or destruction. 
6 Under Article 86, personal data in official documents held by a public authority or 
a public body or a private body for the performance of a task carried out in the 
public interest may be disclosed by the authority or body in accordance with 
Union or Member State law to which the public authority or body is subject in 
order to reconcile public access to official documents with the right to the 
protection of personal data pursuant to that regulation. 
National law 
Law on the protection of personal data 
7 Following the entry into force of the General Data Protection Regulation, a new 
Tietosuojalaki (Law on data protection) was adopted in Finland. Under 
Paragraph 1 of the Law on data protection, that law clarifies and supplements the 
General Data Protection Regulation and the national application thereof. Under 
Paragraph 2 of the Law on data protection, that law is to be applied in accordance 
with the scope of Article 2 of the General Data Protection Regulation. 
8 Under Paragraph 28 of the Law on data protection, the provisions on the public 
nature of authorities’ activity are to apply to the right to obtain data from an 
authority’s register of persons and any other disclosure of personal data from a 
public authority’s register of persons. 
9 Under Paragraph 1(1) of the Laki henkilötietojen käsittelystä rikosasioissa ja 
kansallisen turvallisuuden ylläpitämisen yhteydessä 5.12.2018/1054 (Law on the 
processing of personal data in criminal matters and in connection with the 
maintenance of national security 5.12.2018/1054), that law is to be applied to the 
processing of personal data by competent authorities where, inter alia, criminal 
proceedings before a court are concerned. However, under Paragraph 1(4), the law 
applies only to such processing of personal data within the meaning of 
subparagraph 1 as is wholly or partly automated or where the data to be processed 
form or are intended to form a register or part of a register. Under Paragraph 2(2) 
of that law, the provisions on the public nature of an authority’s activity are to 
apply to the right to obtain data from an authority’s registry of persons and any 
other disclosure of personal data from an authority’s register of persons. 
Law on the public nature of activities 
10 Under Paragraph 1 of the Laki oikeudenkäynnin julkisuudesta yleisissä 
tuomioistuimissa 30.3.2007/370 (Law on the public nature of proceedings before 
ordinary courts 30.3.2007/370), court proceedings and court files are to be public, 
unless otherwise provided for in that law or any other law. Under Paragraph 4 of 
that law, information on the court hearing the case, the exact nature of the case, 
REQUEST FOR A PRELIMINARY RULING OF 30. 11. 2022 – CASE C-740/22 
 
4  
the course of the proceedings and the time and place of the hearing, as well as the 
information necessary to identify the parties, is to be public. Under Paragraph 7(2) 
of that law, everyone is entitled to obtain information from public court files. 
Under Paragraph 13(1) of that law, the way in which information from court files 
is provided is governed by Paragraph 16 of the Laki viranomaisten toiminnan 
julkisuudesta 21.5.1999/621 (Law on the public nature of authorities’ activity 
21.5.1999/621).  
11 Under Article 13(1) of the Law on the public nature of authorities’ activity, a 
request for information on the content of a file must be sufficiently specific to 
enable the authority to clarify which file the request relates to. The authority 
assists the person requesting information in identifying the file from which he or 
she is requesting the information by means of a log or other catalogues. The 
person requesting information need not identify him or herself or state reasons for 
his or her request, save where this is necessary to enable the authority to exercise 
its discretion or determine whether the applicant has a right to information on the 
content of the document. Under Paragraph 13(2), unless otherwise provided for, 
when requesting information from a confidential file, an authority’s register of 
persons or another file from which information may be provided only under 
certain conditions, the applicant must state the purpose for which the information 
is to be used, set out any other circumstances required to clarify the condition for 
disclosure of the information and, where necessary, provide information on how 
the information is to be protected. 
12 Under Paragraph 16(1) of the Law on the public nature of authorities’ activity, 
information on the content of a file is to be provided orally or by making the file 
available for inspection, duplication or hearing at the authority’s premises or by 
providing a copy or printout thereof. Information on the public content of a file is 
to be provided in the manner requested, unless this would entail unreasonable 
interference in official activities on account of the large number of files or the 
difficulty of copying or for other comparable reasons. 
13 Under Paragraph 16(3) of the Law on the public nature of authorities’ activities, 
personal information from an authority’s register of persons may, unless otherwise 
provided for in law, be provided in the form of a copy or printout or in electronic 
form where the recipient is entitled to store and use such personal information 
under the provisions on the protection of personal data. 
Need for and background to the reference for a preliminary ruling 
14 The Court of Appeal is seised of a case concerning the processing of personal data 
in which the adoption of an appropriate decision requires an interpretation of 
Articles 2(1), 4(2) and 86 of the General Data Protection Regulation. 
15 The Court of Justice has held that there is processing of personal data where a 
court grants access to procedural documents containing personal data and such 
access is granted by making copies available to journalists (judgment of 24 March 
ENDEMOL SHINE FINLAND 
 
5 
2022, X and Z v Autoriteit Persoonsgegevens (C-245/20, ECLI:EU:C:2022:216, 
paragraphs 37 to 39). 
16 In the view of the Court of Appeal, it is unclear whether Articles 2(1) and 4(2) of 
the General Data Protection Regulation are to be interpreted as meaning that the 
oral provision of information on possible ongoing or concluded criminal 
proceedings against a natural person constitutes processing of personal data within 
the meaning of the regulation. The Court of Justice has not given any rulings on 
this matter. 
17 In Finland, the processing of personal data by authorities is governed by the Law 
on data protection; however, the restrictions usually associated with processing 
personal data do not have to be complied with in all cases on account of the public 
nature of public authority data (Paragraph 28 of the Law on data protection and 
Paragraph 2(2) of the Law on processing personal data in criminal matters and in 
connection with the maintenance of national security). In order to reconcile the 
protection of personal data with the principle that authorities’ activity must be 
public, Paragraph 16 of the Law on the public nature of authorities’ activities 
restricts the provision of personal data in the form of a copy or printout or in 
electronic form from an authority’s register of persons. Since that paragraph does 
not concern an oral transfer of personal data from an authority’s register of 
persons, it is unclear how the protection of personal data is to be reconciled with 
the principle that authorities’ activities are to be public and how important aspects 
related to the protection of personal data are to be taken into account where 
personal data held in an authority’s register of persons are transferred orally.  
Questions referred for a preliminary ruling 
After giving the parties an opportunity to submit observations on the content of 
the request for a preliminary ruling, the Court of Appeal has decided to stay the 
proceedings and refer the following questions to the Court of Justice for a 
preliminary ruling: 
1. Does an oral transfer of personal data constitute processing of personal 
data within the meaning of Article 2(1) and Article 4(2) of the General 
Data Protection Regulation? 
2. Can public access to official documents be reconciled with the right to 
protection of personal data pursuant to the General Data Protection 
Regulation, in the manner referred to by Article 86 of the regulation, 
by allowing information on criminal convictions or offences of a 
natural person to be obtained from a court’s register of persons without 
restriction where a request is made to transfer the information orally to 
the applicant? 
3. Is it relevant for the answer to Question 2 whether the applicant is a 
company or a private individual? 
REQUEST FOR A PRELIMINARY RULING OF 30. 11. 2022 – CASE C-740/22 
 
6  
…