24

In those circumstances the Korkein hallinto-oikeus (Supreme Administrative Court) decided to stay the proceedings before it and to refer the following questions to the Court for a preliminary ruling: ‘(1) Must the exceptions to the scope of [Directive 95/46] laid down in Article 3(2), first and second indents, thereof be interpreted as meaning that the collection and other processing of personal data carried out by the members of a religious community in connection with door-to-door preaching fall outside the scope of that directive? When assessing the applicability of [Directive 95/46], what significance is to be given, on one hand, to the fact that it is the religious community and its congregations which organise the preaching activity in the course of which the data is collected and, on the other, to the fact this also concerns the personal religious practice of the members of a religious community? (2) Must the definition of a “filing system” in Article 2(c) of … Directive [95/46], examined in the light of recitals 26 and 27 of that directive, be interpreted as meaning that, taken as a whole, the personal data (consisting of names and addresses and other information about and characteristics of a person) collected otherwise than by automatic means in connection with the door-to-door preaching described above (a) does not constitute such a filing system, because the data does not include specific lists or data sheets or any other comparable search method as provided for in the definition laid down in the [Law No 523/1999], or (b) does constitute such a filing system, because, taking account of its intended purpose, the information required for later use may in practice be searched easily and without unreasonable expense in accordance with [Law No 523/1999]? (3) Must the phrase “alone or jointly with others determines the purposes and means of the processing of personal data” appearing in Article 2(d) of … Directive [95/46] be interpreted as meaning that a religious community that organises an activity in the course of which personal data is collected (in particular, by allocating areas in which the activity is carried out among the various preachers, supervising the activity of those preachers and keeping a list of individuals who do not wish the preachers to visit them) may be regarded as a controller, in respect of the processing of personal data carried out by its members, even if the religious community claims that only the individual members who engage in preaching have access to the data that they gather? (4) Must Article 2(d) of Directive [95/46] be interpreted to the effect that in order for a religious community to be considered a controller it must have taken other specific measures, such as giving written instructions or orders directing the collection of data, or is it sufficient that that religious community can be regarded as having de facto control of its members’ activities? It is necessary to answer Questions 3 and 4 only if, on the basis of the answers to Questions 1 and 2, [Directive 95/46] is applicable. It is necessary to answer Question 4 only if, on the basis of Question 3, the application of Article 2(d) of [Directive 95/46] to the Community cannot be regarded as being excluded.’