CELEX: 62007CC0073
Language: en
Date: 2008-05-08
Title: Opinion of Advocate General Kokott delivered on 8 May 2008. # Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy. # Reference for a preliminary ruling: Korkein hallinto-oikeus - Finland. # Directive 95/46/EC - Scope - Processing and flow of tax data of a personal nature - Protection of natural persons - Freedom of expression. # Case C-73/07.

OPINION OF ADVOCATE GENERAL
      KOKOTT
      
      delivered on 8 May 2008 1(1)
      
      Case C‑73/07
      Tietosuojavaltuutettu 
      v 
      Satakunnan Markkinapörssi Oy and Satamedia Oy
      (Reference for a preliminary ruling from the Korkein hallinto-oikeus (Finland))
      (Directive 95/46/EC – Protection of natural persons with regard to the processing of personal data – Protection of the right to privacy – Tax data on income and wealth – Freedom of expression – Media privilege)I –  Introduction
      1.        This case presents the Court with the task of examining the relationship between data protection and the freedom of the press
         and/or media freedom. When Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection
         of individuals with regard to the processing of personal data and on the free movement of such data (2) (‘the Data Protection Directive’ or ‘the Directive’) was adopted, there was awareness of the possible conflict between those
         two fundamental rights and accordingly in Article 9 the Member States were required to reconcile them. In particular, the
         Member States were to provide for the necessary derogations from the data protection rules for the media. The question now
         arises of whether that derogation is to be applied to the alphabetical publication of the tax data of Finnish citizens, including
         details of their income and wealth, as well as making such data available for mobile telecommunication with the aid of a text-messaging
         service. 
      
      II –  Legal context 
      A –    Community law 
      2.        Article 2(a), (b) and (c) of the Data Protection Directive define the central concepts of ‘personal data’, ‘processing’ and
         ‘data filing system’: 
      
      ‘For the purposes of this Directive:
      (a)      “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable
         person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to
         one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
      
      (b)      “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal
         data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval,
         consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking,
         erasure or destruction;
      
      (c)      “personal data filing system” (“filing system”) shall mean any structured set of personal data which are accessible according
         to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis’.
      
      3.        Building up from that, Article 3(1) regulates the scope of the Directive:
      
      ‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing
         otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing
         system.’ 
      
      4.        The relationship between data protection and media and press freedom is regulated in Article 9: 
      
      ‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI
         for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression
         only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’ 
      
      5.        This provision is explained in recitals 17 and 37: 
      
      ‘(17) … as far as the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic
         expression is concerned, in particular in the audiovisual field, the principles of the Directive are to apply in a restricted
         manner according to the provisions laid down in Article 9;
      
      …
      (37)      … the processing of personal data for purposes of journalism or for purposes of literary of artistic expression, in particular
         in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so
         far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right
         to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection
         of Human Rights and Fundamental Freedoms; … Member States should therefore lay down exemptions and derogations necessary for
         the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, measures
         on the transfer of data to third countries and the power of the supervisory authority; … this should not, however, lead Member
         States to lay down exemptions from the measures to ensure security of processing; … at least the supervisory authority responsible
         for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report or to refer matters to the judicial authorities’. 
      
      6.        Article 17(1) regulates the security requirements for data processing:
      
      ‘Member States shall provide that the controller must implement appropriate technical and organisational measures to protect
         personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access,
         in particular where the processing involves the transmission of data over a network, and against all other unlawful forms
         of processing.
      
      Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security
         appropriate to the risks represented by the processing and the nature of the data to be protected.’
      
      7.        The other paragraphs of Article 17 regulate the application of these obligations to the processing of data by third parties
         on behalf of other persons. 
      
      B –    National law
      8.        Paragraph 10(1) of the Finnish Constitution (Perustuslaki) protects the right to privacy, but Paragraph 12 protects freedom
         of expression and public access to information held by the authorities:
      
      ‘Everyone shall have the right to freedom of expression. Freedom of expression entails the right to express oneself and to
         disseminate and receive information, opinions and other communications without prior hindrance. More detailed provisions relating
         to the exercise of the right to freedom of expression shall be laid down by law. 
      
      Documents and other records in the possession of the authorities shall be in the public domain, unless specifically restricted
         by law for compelling reasons. Every person shall have the right of access to public documents and records.’
      
      9.        Under Paragraph 5(1) of the Law on the public disclosure and confidentiality of tax information (Laki verotustietojen julkisuudesta
         ja salassapidosta), in the annual assessment of income tax the taxpayer’s name, year of birth and municipality of domicile
         are tax information in the public domain. The following data are also in the public domain:
      
      1.      Earned income for the purposes of national taxation;
      2.      Unearned income and income from property for the purposes of national taxation;
      3.      Earned income for the purposes of municipal taxation;
      4.      Taxes on income and property, municipal taxes and the total amount of taxes and charges levied.
      10.      In principle, this information is provided by the authorities orally upon request, but the document may be made available
         for examination, for making a copy or for being listened to, or a copy or printout will be provided. The following provisions
         (Paragraph 16(3) of the Law on public access (Julkisuuslaki)) govern the disclosure of data from a personal data file of an
         authority:
      
      ‘A file containing personal data may be disclosed in the form of a printout, or those data may be disclosed in electronic
         form, unless provided otherwise by law, if the recipient is authorised to store and use such data by virtue of the provisions
         governing the protection of personal data. However, access to personal data for the purposes of direct marketing, market surveys
         or market research shall not be permitted unless specifically provided for by law or if the data subject has given his consent.’
      
      11.      Finland implemented the Data Protection Directive by means of the Law on personal data (Henkilötietolaki). Paragraph 2(4)
         and (5) contain the restrictions on the application of the law which relate to the present case:
      
      ‘(4)      This law does not apply to personal data files containing, solely and in unaltered form, data that have been published by
         the media.
      
      (5)      Unless otherwise provided in Paragraph 17, only Paragraphs 1 to 4, 32, 39(3), 40(1) and (3), 42, 44(2), 45 to 47, 48(2), 50,
         and 51 of this law apply, where appropriate, to the processing of personal data for purposes of journalism or artistic or
         literary expression.’
      
      12.      So far as can be seen, the only one of those provisions which concerns the present case is Paragraph 32(1):
      
      ‘The controller shall carry out the technical and organisational measures necessary for protecting personal data against unauthorised
         access, accidental or unlawful destruction, manipulation, disclosure, transfer or other unlawful processing. The techniques
         available, the associated costs, the quality, quantity and age of the data, as well as the significance of the processing
         to the protection of privacy shall be taken into account when carrying out the measures.’
      
      III –  Facts, national proceedings and reference for a preliminary ruling 
      13.      According to the court making the reference, Satakunnan Markkinapörssi Oy collected for its own use tax data on individuals
         available from the tax authorities. Using those data, it published each year what was in appearance a newspaper containing
         a list giving tax information concerning approximately 1.2 million natural persons. 
      
      14.      The data included the surname and forename of the person concerned, together with the tax data relating to earned and unearned
         income and net worth to the nearest EUR 100. The data were published in regional publications (of which there were 16 in 2001).
         The information was arranged alphabetically by municipality and income category.
      
      15.      The lower limit for the data to be published was selected by reference to municipalities. For example, the limit in respect
         of earned income for Helsinki was EUR 36 000. The lower limit was less in smaller municipalities.
      
      16.      The main aim is the publication of tax data. At the same time the publication contains summaries and other articles, in addition
         to advertisements. In comparison with tax information, the other items take up much less space. 
      
      17.      Satakunnan Markkinapörssi Oy makes a charge for the removal from the periodical of data concerning individuals. According
         to that company, however, removal is not conditional on payment of the charge. 
      
      18.      Satakunnan Markkinapörssi Oy transferred the published personal data on a CD-ROM to Satamedia Oy, which is another company
         owned by the same persons. 
      
      19.      The two companies agreed with another company, a mobile radiocommunications service, on the technical operation of a text-messaging
         service. For that purpose, Satamedia Oy transferred the data in question to the third company, which supplied text-messaging
         services on behalf of Satamedia Oy. 
      
      20.      In the context of that service, a mobile phone user sends the message: TAX FORENAME SURNAME PLACE (for example, TAX MATTI
         MEIKÄLÄINEN HELSINKI) to a given number. In reply, the data on the earned income, unearned income and net worth to the nearest
         EUR 100 are sent to the mobile phone. In 2004, the text-messaging service also showed the data for other people with the same
         name and comparative data for the respective municipality. A charge is made for a successful text message. The company also
         removes data from the service upon request.
      
      21.      The Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) investigated the activity of Satakunnan Markkinapörssi Oy and
         Satamedia Oy and applied to the Data Protection Board to prohibit:
      
      (a)      Satakunnan Markkinapörssi Oy from
      –        collecting and recording or otherwise processing data on the taxable earnings and income from capital and the wealth of natural
         persons to the extent and in the manner that occurred in respect of the tax data for the year 2001, and
      
      –        disclosing the aforementioned personal data it had collected and entered on a data file allegedly for journalistic purposes
         to text-messaging services or for other purposes;
      
      (b)      Satamedia Oy from collecting, recording and disclosing personal data obtained from the data files held by Satakunnan Markkinapörssi
         Oy to text-messaging services or for other purposes.
      
      22.      The Data Protection Board dismissed this application. The action brought against this was unsuccessful at first instance.
         The Data Protection Ombudsman has now lodged an appeal to the Supreme Administrative Court of Finland (Korkein hallinto-oikeus).
      
      23.      As a result, the Korkein hallinto-oikeus has referred the following questions to the Court for a preliminary ruling pursuant
         to Article 234 EC: 
      
      ‘(1)  Can an activity in which data relating to the earned and unearned income and assets of natural persons are:
      (a)      collected from documents in the public domain held by the tax authorities and processed for publication,
      (b)      published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
      (c)      transferred onward on CD-ROM to be used for commercial purposes, and
      (d)      processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
         details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the
         earned and unearned income and assets of that person,
      
      be regarded as the processing of personal data within the meaning of Article 3(1) of [the Directive]?
      (2)      Is [the Directive] to be interpreted as meaning that the various activities listed in Question 1(a) to (d) can be regarded
         as the processing of personal data carried out solely for journalistic purposes within the meaning of Article 9 of the Directive,
         having regard to the fact that data on over one million taxpayers have been collected from information which is in the public
         domain under national legislation on the right of public access to information? Does the fact that publication of those data
         is the principal aim of the operation have any bearing on the assessment in this case?
      
      (3)      Is Article 17 of [the Directive] to be interpreted in conjunction with the principles and purpose of the Directive as precluding
         the publication of data collected for journalistic purposes and its onward transfer for commercial purposes?
      
      (4)      Is [the Directive] to be interpreted as meaning that personal data files containing, solely and in unaltered form, material
         that has already been published in the media fall altogether outside its scope?’
      
      24.      Satakunnan Markkinapörssi Oy and Satamedia Oy jointly, Estonia, Portugal, Finland, Sweden and the Commission have lodged pleadings.
         In addition, the Finnish Data Protection Ombudsman took part in the hearing of 12 February 2008, while Portugal was not represented.
         
      
      25.      The President of the Court dismissed an application by the European Data Protection Supervisor for leave to intervene in the
         procedure because intervention in preliminary ruling proceedings is not possible and the Supervisor is not mentioned as a
         party in Article 23 of the Statute of the Court of Justice. (3)
      
      IV –  Legal assessment
      26.      The issue in the main proceedings is whether the dissemination of tax data by Satakunnan Markkinapörssi Oy and Satamedia Oy
         is inconsistent with data protection. Accordingly the national court’s first question is whether and to what extent the operation involving the tax data in question falls within the scope of the Data Protection
         Directive.
      
      27.      Under Paragraph 2(5) of the Finnish Law on personal data, only specific data protection provisions apply to the processing
         of personal data for journalistic purposes. Paragraph 32(1), which transposes the requirements concerning security in processing
         laid down by Article 17 of the Data Protection Directive, appears to be the only restriction on processing. The third question relates to the interpretation of that provision.
      
      28.      In addition, with its second question the national court seeks another starting point for the application of data protection rules, namely the interpretation of
         Article 9 of the Data Protection Directive, which requires the Member States to reconcile freedom of expression with the right
         to privacy. This is to be done by means of derogations from the data protection rules where personal data are used solely
         for journalistic purposes or the purpose of artistic or literary expression. Therefore the question before the Court is whether
         and, if so, to what extent journalistic purposes can be recognised in the present case. 
      
      29.      The fourth question seeks to determine whether a further Finnish derogation from the data protection rules, namely the exception for the processing
         of published data under Paragraph 2(4) of the Law on personal data, is compatible with Community law. 
      
      A –    The first question – Processing of personal data 
      30.      First of all, the national court asks whether the scope of the Data Protection Directive extends to various activities of
         Satakunnan Markkinapörssi Oy and Satamedia Oy.
      
      31.      The national court and the parties correctly agree that the publication of tax data and making them available in the form
         of a text-messaging service are to be regarded as the processing of personal data within the meaning of Article 2(a) and (b)
         of the Data Protection Directive.
      
      32.      The data in question are personal data as the information on income, wealth and taxes are associated with identified persons.
         Both publication and making available as a text-messaging service require different operations within the meaning of Article
         2(b) of the Data Protection Directive, for example, collection, recording, organisation, storage and disclosure by transmission,
         dissemination or otherwise making available.
      
      33.      In addition, for the Data Protection Directive to apply, Article 3(1) requires the processing of personal data wholly or partly
         by automatic means, or the processing otherwise than by automatic means of personal data which form part of a filing system
         or are intended to form part of a filing system. A filing system is any structured set of personal data which are accessible
         according to specific criteria.
      
      34.      It is probable that the operations referred to by the national court are carried out at least partly by automatic means, in
         any case leaving aside disclosure by CD-ROM. However, the automation of disclosure requires no further explanation because
         the publication of tax data on paper constitutes a filing system and disclosure in the form of a text-messaging service presupposes
         the consultation of a filing system. Consequently all the abovementioned activities, including disclosure of data by means
         of CD-ROM, involve the processing of personal data which form part of, or are intended to form part of, a filing system. 
      
      35.      Consequently the reply to the first question must be that an operation is to be regarded as the processing of personal data
         within the meaning of Article 3(1) of the Data Protection Directive if the data of natural persons relating to their earned
         income, income from capital and wealth, as described in the reference for a preliminary ruling, are:
      
      (a)      collected from documents in the public domain held by the tax authorities and processed for publication,
      (b)      published alphabetically in a printed publication by income bracket and municipality in the form of extensive lists,
      (c)      disclosed onward on CD-ROM to be used for commercial purposes, or
      (d)      processed for the purposes of a text-messaging service whereby mobile phone users can, by indicating an individual’s name
         and home municipality and texting to a given number, receive in reply data on the earned income, income from capital and wealth
         of the individual indicated.
      
      B –    The second question – The exception for journalistic activities
      36.      The second question from the national court is whether the operations to which the main proceedings relate can be regarded
         as the processing of personal data solely for journalistic purposes within the meaning of Article 9 of the Data Protection
         Directive. Article 9 is the legal basis for the formulation by the Member States of the so-called press or media privilege. (4) This means that the Member States provide for exemptions and derogations from Chapters II, IV and VI of the Data Protection
         Directive for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary
         expression only if that is necessary in order to reconcile the right to privacy with the rules governing freedom of expression.
         Consequently the issue in the second question is the scope of that exemption.
      
      The relevant fundamental rights
      37.      The interpretation of Article 9 of the Data Protection Directive must be guided by the fundamental rights which are to be
         reconciled by the application of that provision. In doing so, the Community Courts must take into account the case-law of
         the European Court of Human Rights in particular. (5)
      
      38.      Community law guarantees the fundamental right of freedom of expression embodied in Article 10 of the European Convention
         for the Protection of Human Rights and Fundamental Freedoms (ECHR), signed in Rome on 4 November 1950. (6) This is recognised in Article 11 of the Charter of Fundamental Rights of the European Union (‘the Charter’), proclaimed in
         Nice on 7 December 2000. (7) In accordance with the case-law of the Court of Justice (8) and the Protocol on the system of public broadcasting in the Member States, (9) in particular the freedom and pluralism of the media are respected in accordance with Article 11(2) of the Charter. 
      
      39.      Freedom of expression is not confined to the expression of opinions but expressly includes, pursuant to the second sentence
         of Article 10(1) of the ECHR and the first sentence of Article 11(1) of the Charter, freedom to receive and impart information
         and ideas in the sense of freedom of communication. The European Court of Human Rights has consistently held that freedom
         of expression is applicable not only to information or ideas that are favourably received or regarded as inoffensive or as
         a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population. (10) Freedom of expression protects the transmission of information and the expression of opinion even for commercial purposes. (11)
      
      40.      The fundamental right to respect for private life is laid down in Article 8 of the ECHR and is recognised in Article 7 of
         the Charter. Furthermore, Article 8 of the Charter expressly proclaims the right to the protection of personal data. (12) The communication of personal data to a third party infringes the right of the persons concerned to respect for private life,
         whatever the subsequent use of the information thus communicated, and constitutes interference within the meaning of Article
         8 of the ECHR. (13)
      
      41.      The right to respect for private life is not purely a defence against arbitrary interference by public authorities, but also
         creates positive obligations on the part of the State. (14) Therefore the Community has, by means of the Data Protection Directive, extended data protection to processing by individuals.
         To that effect, the European Court of Human Rights has also pointed out, in a case concerning the use of photographs involving
         the private life of a prominent person, that increased vigilance is necessary to contend with new communication technologies
         which make it possible to store and reproduce personal data. (15)
      
      42.      The restriction of both fundamental rights is in principle permissible, subject to comparable conditions. It must be laid
         down by law, it must conform with one or more of the legitimate aims of Article 8 or Article 10 of the ECHR and it must be
         necessary in a democratic society, that is to say, an imperative need may justify interference if it is in reasonable proportion
         to the legitimate aim in question. (16)
      
      43.      Strict application of the data protection rules could substantially limit freedom of expression. Investigative journalism
         would to a large extent be ruled out if the media could process and publish personal data only with the consent of, or in
         conformity with information provided by, the person concerned. On the other hand, it is obvious that the media may violate
         the right of individuals to respect for their private life. (17) Consequently a balance must be found. 
      
      44.      This situation of conflict between different fundamental rights and also between data protection and other general interests
         is characteristic of the interpretation of the Data Protection Directive. (18) As a result, the relevant provisions of the Directive are formulated in relatively general terms. They allow the Member States
         the necessary margin of discretion in adopting implementation measures which can be adjusted to the various conceivable situations. (19) In that context, the Member States must respect the position with regard to the fundamental rights concerned and reconcile
         them.
      
      45.      In addition, according to the Court, it is for the authorities and courts of the Member States not only to interpret their
         national law in a manner consistent with the Data Protection Directive, but also to make sure they do not rely on an interpretation
         of it which would be in conflict with the fundamental rights protected by the Community legal order or with the other general
         principles of Community law. (20)
      
      The national court’s right of assessment
      46.      In contrast to the requirements for the domestic courts and authorities, the Court of Justice is very cautious with regard
         to determining the scope of data protection and weighing up conflicting fundamental rights. In Promusicae, the Court merely designated the two fundamental rights and left the national court to strike a fair balance between them. (21) In Österreichischer Rundfunk and Others, the Court took a similar approach, (22) but also gave the national court some guidance. (23)
      
      47.      The Court shows the same caution in other situations of conflicting rights. In Familiapress, the issue was the conflict between the free movement of goods and a domestic prohibition of prize competitions in periodicals.
         In that judgment, the Court made an express decision on the need for certain rules, (24) but in general left the national courts to determine whether that prohibition was proportionate to the maintenance of press
         diversity and whether that objective could not be achieved by less restrictive means. (25)
      
      48.      In cases of conflict between the freedom to provide services and human dignity, and between the free movement of goods and
         ideas on the protection of children and young persons, the Court has gone even further in recognising that in the Member States
         there may be differing, but equally legitimate, views on what restrictions on fundamental freedoms for the protection of public
         interests and, in particular, fundamental rights are proportionate. (26)
      
      49.      On the other hand, the Court has also pointed out that it is called on to provide answers of use to the national courts. In
         particular, it may provide guidance, based on the file in the main proceedings and on the written and oral observations which
         have been submitted to it, in order to enable the national court to give judgment in the particular case before it. (27) Such guidance normally relates to problems of proportionality. 
      
      50.      In the present case, the Court should rather follow the cautious line. It falls to the Community Courts to put conflicting
         fundamental rights into concrete terms above all where the focus is on cross-border activities. If there are indications of adverse effects on Union citizens engaged in cross-border activities, a particularly
         thorough examination is necessary. This is shown by the judgments on trade union activities with reference to cross-border
         services (28) or to the relocation of a business undertaking (29) and on attacks by protesting farmers on lorries carrying fruit. (30)
      
      51.      The Schmidberger case (31) is not an example of the opposite. It concerned interference with goods vehicles between Germany and Italy by a permitted
         demonstration on the Austrian Brenner motorway. Although in that case the Court acknowledged the wide discretion of the national
         authorities in striking a balance between the free movement of goods and the freedom of expression and freedom of demonstration, (32) it discussed in relative detail the outcome of striking such balance (33) before finding that there was no breach of Community law. 
      
      52.      On the other hand, where the Data Protection Directive is to be applied, the protection of cross-border activities is the
         exception. The Directive is based on Article 95 EC and thus serves the establishment of the internal market. However, it covers
         not only cross-border data processing but also purely domestic operations. Unlike Advocate General Tizzano, (34) the Court did not call into question the wide-ranging scope of the Directive because, if it were confined to situations with
         cross-border elements, that would make the limits of its field of application uncertain and it would depend on fortuitous
         circumstances. (35)
      
      53.      However, it must be concluded from the broad scope of the Data Protection Directive, which already reaches almost beyond the
         establishment of the internal market, that the Court, when striking a balance between conflicting fundamental rights in the
         context of the Directive, should in principle allow the Member States and their courts a broad discretion within which their
         own traditions and social values can be applied.
      
      54.      That is the background against which Article 9 of the Data Protection Directive is to be interpreted.
      
      The scope of Article 9 of the Data Protection Directive 
      55.      Under Article 9 of the Data Protection Directive, the Member States are to provide for derogations from the data protection
         provisions for the processing of personal data carried out solely for journalistic purposes or the purpose of literary or
         artistic expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.
         
      
      56.      Satakunnan Markkinapörssi Oy, Satamedia Oy and Finland wish to extend the scope of Article 9 of the Data Protection Directive
         to cover the entire protected area of freedom of expression. According to that interpretation, Article 9 would, in accordance
         with its aim, cover all conceivable conflicts between freedom of expression and data protection. At the same time, the Member
         States would be given the greatest possible freedom to reconcile data protection and freedom of expression.
      
      57.      However, there is no basis for that interpretation in the wording of Article 9 of the Data Protection Directive, which not
         only requires data protection and freedom of expression to be reconciled, but also describes certain aims for the purpose
         of which the Member States may derogate from almost all the requirements of the Data Protection Directive. The concepts of
         journalistic purposes or the purpose of literary or artistic expression, which are used in that context, would be left with
         no function of their own besides the concept of freedom of expression if, taken together, they were equated with freedom of
         expression.
      
      58.      The starting point for the interpretation of Article 9 of the Data Protection Directive should rather be that exceptions to
         a general principle must be interpreted strictly (36) in order not to undermine the general principle unduly. In the present case, there would be a risk of encroaching on the
         fundamental right to privacy if Article 9 were interpreted too broadly.
      
      59.      The need for restrictive interpretation is clear from Article 9 of the Data Protection Directive in so far as it relates only
         to the processing of personal data which is carried out solely for the specified purposes. In addition, exemptions and derogations are allowed only if they are necessary to reconcile the fundamental rights in question.
      
      60.      As the Commission in particular points out, the wide range of the exception allowed under Article 9 also indicates that the
         conditions for applying it should be interpreted restrictively. Whereas other exceptions under the Data Protection Directive
         provide for derogations only from specific provisions, Article 9 makes it possible to suspend almost all the requirements
         of the Directive. 
      
      61.      A literal interpretation of the term ‘journalistic purposes’ cannot be met with the objection that it would lead to encroachment
         on the freedom of expression as a result of data protection requirements which are too restrictive. The Member States need
         not reconcile freedom of expression and the right to privacy solely in the context of Article 9 of the Data Protection Directive.
         They may also rely on other provisions since the Directive as a whole leaves the Member States with the necessary discretion
         to define transposition measures which may be adapted to the various situations possible. (37)
      
      62.      In the sphere of the private expression of opinion, the Member States are particularly free as, under the second indent of
         Article 3(2), the Data Protection Directive does not apply to the processing of personal data by a natural person in the course
         of a purely personal or household activity. (38)
      
      63.      In addition, under Article 7(f) of the Directive, processing is permissible if it is necessary for the purposes of the legitimate
         interests pursued by the controller, or the Member State concerned may, under Article 13(1)(g), provide for exceptions to
         certain rules for the protection of the rights and freedoms of other persons. (39) In particular, the requirements concerning the permissibility of data processing under Article 7 and the processing of sensitive
         data under Article 8 are applicable in those cases, and the data protection supervisory authorities may oversee the processing
         of the data.
      
      64.      To sum up, therefore, the scope of Article 9 of the Data Protection Directive must be determined by reference to the concepts
         of journalistic, literary or artistic purposes, which have a meaning of their own that is not identical with the protected
         area of freedom of expression. 
      
      The concept of journalistic purposes
      65.      The concept of journalistic purposes refers to the activity of the mass media, particularly the press and audiovisual media.
         The origin of the Data Protection Directive shows that journalistic purposes are not confined to the activity of institutionalised
         media. As the Commission initially proposed an exception for press organs and audiovisual media, (40) the term ‘journalistic purposes’ resulted from several succeeding drafts which broadened the scope of the exception for media
         undertakings and extended it to all persons engaging in journalistic activity. (41)
      
      66.      To give further definition to the concept of journalistic purposes, account should be taken of the task of the media in a
         democratic society, as formulated by the European Court of Human Rights in its case-law on the restriction of the freedom
         of expression. Any restriction on the freedom of expression in a democratic society is conditional on such restriction being
         necessary. If the media are affected, it must be borne in mind that a free press plays a vital part in the functioning of
         a democratic society, particularly as a ‘public watchdog’. Therefore it has a duty to impart information and ideas on all
         matters of public interest. (42)
      
      67.      As the issue is the communication of information and ideas, the question is not whether the data disseminated are processed
         or commented upon by editors, contrary to the views held in some quarters. The mere fact of making raw data available may
         contribute to public debate and therefore be of public interest. Furthermore, the selection of the disseminated data is in
         itself an expression of a subjective evaluation of the person disseminating them. The fact of selection implies at least a
         belief that the data are of interest to the recipient. 
      
      68.      As the Swedish Government in particular maintains, the dissemination of personal data pursues journalistic purposes if it
         aims to impart information and ideas on matters of public interest. 
      
      Information and ideas on matters of public interest
      69.      Now it is necessary to ascertain what is meant by the imparting of information and ideas on matters of public interest. This
         phrase describes acts by way of exercising the freedom of expression, the restriction of which requires particularly weighty
         justification. 
      
      70.      In that connection, the Swedish Government refers to a statement it made when adopting the Data Protection Directive. According
         to the statement, journalistic purposes depend, not on the information imparted, that is to say, the subject-matter, but on
         the nature of the communication. It is right to say that it is not incumbent on State authorities to lay down the matters
         of public interest with which the media may deal. Therefore examination of the subject-matter is a sensitive issue.
      
      71.      The nature and context of the information are relevant in order to distinguish cases where, although information or ideas
         on matters of public interest are communicated, the communication is not addressed to the public, for example, private political
         debate.
      
      72.      However, differentiation solely on the basis of the form of communication is no longer sufficient to identify journalistic
         purposes. At one time journalism was confined to media which were (relatively) clearly recognisable as such, namely the press,
         radio and television. Modern means of communication such as the internet and mobile telecommunications services are used just
         as much for the communication of information on matters of public interest as for purely private purposes. Consequently, although
         the type of communication is an important factor in determining whether journalistic purposes are being pursued, the subject-matter
         should not be disregarded either.
      
      73.      Public interest arises in any case where the information communicated relates to a public debate which is actually being conducted. (43) There are also topics which are by nature matters of public interest, for example, public hearings within the meaning of
         Article 6(1) of the ECHR, (44) the public interest in the transparency of political life (45) and information on the ideas and attitudes, as well as the conduct, of prominent politicians. (46)
      
      74.      On the other hand, it is doubtful whether information on matters of public interest is being communicated where details of
         an individual’s private life are disseminated which have no connection with a public function of the person concerned, particularly
         where their sole purpose is to satisfy the curiosity of a particular readership regarding an individual’s private life and
         they cannot be deemed to contribute to any debate of general interest to society despite that individual being known to the
         public. (47) What is particularly important for this borderline of public interest is whether the person concerned has a legitimate expectation
         of respect for his or her private life. (48)
      
      75.      The Fressoz and Roire (49)case affords a good illustration of the relevant considerations. This concerned the conviction of two journalists who published
         confidential documents from a tax file in order to substantiate their information concerning the income of a company director.
         Such publication was in principle punishable under domestic law. 
      
      76.      In response, the European Court of Human Rights stressed that the information related to a public debate concerning pay which
         had been started by an industrial dispute in the company concerned. (50) Furthermore, information on tax assessments and taxes paid was not strictly confidential under domestic law. (51) On the contrary, details of remuneration in major companies were regularly published (52) and, according to domestic case-law, did not concern the private life of the persons involved. (53)
      
      77.      Consequently information and ideas relate to a matter of public interest where they link up with a public debate which is
         actually taking place or where they concern questions which, according to domestic law and social values, are by nature public
         issues, but not where details of an individual’s private life are disseminated which have no connection with a public function
         of the person concerned, particularly where there is a legitimate expectation of respect for private life. 
      
      78.      However, it must be added that State authorities, including the courts, cannot ascertain exactly where there are journalistic
         purposes. It is hardly possible to determine in advance what information relates to matters of public interest and, in the
         final analysis, it is at least partly up to the media to create public interest in the first place by the communication of
         information. If they fail to do so, they can hardly be blamed in retrospect. But even ex ante it is not in principle the task of State authorities to predict what will be of no public interest in the future. That would
         be a first step on the path to censorship. Consequently whether the dissemination of information and ideas affects matters
         of public interest can only be established if such dissemination is overt.
      
      Sole purpose
      79.      Even if processing is for journalistic purposes, Article 9 of the Data Protection Directive is not necessarily applicable.
         The processing of the personal data in question must be solely for journalistic purposes. 
      
      80.      The use of the word ‘solely’ in Article 9 serves as a reminder of the specific purpose of data processing which is laid down
         in general terms in Article 6(b) of the Data Protection Directive. According to this, personal data may not in principle be
         further processed in a way incompatible with the purposes for which they were collected. Consequently the Article 9 exception
         can apply only to processing operations which serve journalistic purposes alone. If there are other purposes at the same time
         which are not to be recognised as journalistic, the media privilege will not be applicable.
      
      81.      However, the precise purpose cannot depend on whether processing involves the direct communication of such information, for
         example, in the case of publication of such data. As Satakunnan Markkinapörssi Oy and Satamedia Oy contend, journalistic purposes
         are also pursued in the preparation of a publication. (54)
      
      82.      Processing solely for journalistic purposes is not ruled out either where, in addition to the communication of information
         and ideas on matters of public interest, commercial aims are also pursued. (55) As a rule, journalistic purposes go hand in hand with the aim of at least covering the costs of journalistic activity and,
         if possible, also making a profit. Commercial success is the prerequisite of professional journalism, at least in so far as
         it is carried on independently of the support and influence of others, such as the State. Consequently earning money by communicating
         information and ideas on matters of public interest is a permissible element in journalistic purposes. 
      
      83.       This must be distinguished from commercial activities which do not involve the communication of information and ideas on
         matters of public interest, even if the profits gained are intended to finance journalistic activities. These do not differ
         from activities of the same kind, the profit from which is not intended for journalistic purposes. In that situation, allowing
         the media privilege could breach the principle of equal treatment and distort competition. (56)
      
      84.      Consequently only in exceptional cases would the dissemination of advertisements in the media be likely to involve solely
         the communication of information and ideas on matters of public interest, (57) that is to say, serve solely journalistic purposes, even if the income earned is a prerequisite of media activity.
      
      85.      In any particular case, it is difficult to classify activities as being for journalistic purposes and it requires an appraisal
         of the objective in question. It cannot depend on the objective stated by those responsible for the data processing as those
         subjective aims cannot be verified. Rather, the purpose of the data processing must be based on objective factors. (58)
      
      Application to the present case
      86.      In an individual case, whether certain information is in the public domain and whether there is a legitimate expectation of
         respect for private life depend very much on the position in the relevant domestic law, social values and existing public
         issues. In principle, it is not the task of the Court, but of the competent authorities of the Member States, to examine those
         factors. If such questions are referred to the Court by national courts, it should only give guidance on the circumstances
         to be taken into account. 
      
      87.      In the present case, the nature of the processed information, the different forms of data dissemination and the possibility
         of erasing a person’s own data are of particular interest. 
      
      88.      All processing operations concern personal tax data. In Community law, there are no provisions for the confidential treatment
         of such data, but some Member States regard them as confidential. Consequently in those States the persons concerned rightly
         expect that confidentiality to be respected in principle. Likewise in the Court’s opinion information on income should in
         principle be disclosed only if that is necessary for an overriding purpose. (59)
      
      89.      However, evidently the European Court of Human Rights does not infer the confidential treatment of tax information necessarily
         from Article 8 of the ECHR. (60) Therefore it could be a permissible, that is to say, legitimate, interference in the fundamental Community right to privacy
         if such data in the hands of the tax authorities in Finland are by law accessible to the public. As that is the legal situation,
         it must also be presumed that Finnish citizens have no legitimate expectation with regard to the confidential treatment of
         their tax information.
      
      90.      The information is disclosed in two ways. On the one hand, it is published as a complete list in the external form of a newspaper
         and, on the other, individual taxpayers’ data can be retrieved in the form of a text-messaging service. 
      
      91.      The publication of the list is, according to its form, directed at communicating information of public interest. The general
         public is offered a complete collection of data. Prima facie, that form of publication does not take individual interests
         into account. 
      
      92.      It is more difficult to judge whether, from the viewpoint of content also, that form of communication meets a public interest.
         On the one hand, the public may be interested in obtaining a comprehensive survey of taxation and the tax and wealth situation
         of fellow citizens. There may also be a specific public interest in obtaining such information in relation to particular public
         figures. 
      
      93.      On the other hand, there are also grounds for presuming that interest in such data is broadly of a private nature. Personal
         curiosity on the part of neighbours and acquaintances may be in evidence. Even commercial interests cannot be ruled out. Information
         on the income and wealth of individuals can be used in trade or commerce, for example, for targeted advertising or for assessing
         the financial capability or the creditworthiness of customers.
      
      94.      In the case of the text-messaging service, the last-mentioned factors are much more in evidence because, by virtue of its
         form, it is used to obtain information only where there is a specific interest in the figures for a particular person. It
         seems unlikely that such interest is normally of a public nature. On the contrary, consultation is likely to be connected
         with matters of public interest only in exceptional cases. 
      
      95.      However, public interest cannot be ruled out altogether in the case of information transmission by way of telecommunications.
         The transmission of information by telecommunications services is increasingly supplementing traditional forms of transmission
         by means of the press and the mass media. Consequently whether information and ideas on matters of private or public interest
         are transmitted in that form is a question requiring particularly careful consideration.
      
      96.      Finally, the Portuguese Government submits that, if Satakunnan Markkinapörssi Oy makes a charge for deleting taxpayers from
         the data-processing system, no journalistic purposes are involved. This argument would have to be accepted if Satakunnan Markkinapörssi
         Oy were seeking to make a profit from the charges as there would be no profit precisely from transmitting information and
         ideas on matters of public interest. If, on the other hand, the charge is simply to cover expenses, that does not in itself
         rule out journalistic purposes, irrespective of whether such charges are lawful.
      
      97.      However, the fact that an individual can have data relating to himself or herself erased raises the question of whether there
         actually is a public interest in a comprehensive list of tax data. The erasure of individual tax records without reason would
         then in principle be contrary to the public interest, if any. If the reader expects a comprehensive list, erasure would be
         almost misleading because the impression would be given that that person pays little or no tax. 
      
      98.      The national courts must decide how to evaluate conclusively those objective factors in the social environment in Finland,
         if necessary, after further clarification of the factual situation. 
      
      Striking a balance between freedom of expression and the right to privacy 
      99.      If Article 9 of the Data Protection Directive is prima facie applicable, it does not immediately follow that the processing
         of personal data in question is to be exempted from data protection. Rather, derogations are permissible only if they are
         shown to be necessary in order to reconcile the right to privacy with the rules governing freedom of expression. 
      
      100. Accordingly it would be possible to agree with Estonia and the Commission in doubting whether the Finnish implementation of
         Article 9 fulfils the requirements of Community law. In spite of the flexibility of the rules of the Data Protection Directive, (61) it seems on an overall view somewhat one-sided to exclude data protection almost entirely in relation to data processing
         for journalism. Therefore under Community law it may be necessary to subject journalistic activities to stricter data protection
         obligations than was done in Paragraph 2(5) of the Finnish Law on personal data.
      
      101. However, these considerations are not relevant for a reply to the second question from the national court. In the main proceedings,
         an application has been made to order Satakunnan Markkinapörssi Oy and Satamedia Oy to refrain from certain data-processing
         operations. That order cannot be based directly on the Data Protection Directive. A directive may not of itself impose obligations
         on an individual and cannot therefore be relied upon as such against an individual. (62)
      
      102. In contrast, the Commission proposes, with reference to Paragraph 2(4) of the Finnish Law on personal data, that national
         restrictions of data protection should be set aside on account of violation of the right to privacy. The Commission finds
         support in the Mangold judgment, where the Court regarded the principle of non-discrimination on grounds of age laid down in Directive 2000/78 (63) as a general principle of Community law and concluded that the national courts should set aside any contrary provision of
         national law. (64)
      
      103. I have already rejected that approach in another case. (65) To have recourse to a general principle of law instead of a directive which cannot be relied upon directly as against an
         individual, when that general principle is much less clear and certain, would circumvent the directive’s aim of harmonisation,
         raise concerns as to its aim of legal certainty and undermine the prohibition on giving effect, directly as against individuals,
         to provisions of directives which have not been implemented. Advocates General Mazák and Ruiz-Jarabo Colomer also fear that
         the direct application of general legal principles in addition to directives would undermine the latter in their effect, call into question the attribution of powers and create legal uncertainty. (66)
      
      104. These are precisely the consequences that would arise in the present case. The obligations of individuals concerning data
         protection are based on national rules which implement the Data Protection Directive. The Commission’s approach, on the other
         hand, amounts to creating obligations which are contrary to the national rules. This is not consistent with legal certainty.
         It would also undermine the attempt by the Data Protection Directive to entrust the Member States with striking a balance
         between data protection and freedom of expression. 
      
      105. Consequently in the present case it is immaterial whether Finland has correctly implemented Article 9 of the Data Protection
         Directive. The national court must determine whether there is a basis in national law for the orders which have been applied
         for against Satakunnan Markkinapörssi Oy and Satamedia Oy. For that purpose, the national court must so far as possible interpret
         its national law in the light of the wording and the purpose of the Data Protection Directive (67) and in accordance with fundamental Community rights (68) in order to achieve the result laid down in the Directive. The obligation of conforming interpretation is at the same time
         limited by the principle of legal certainty. This precludes an interpretation of national law contra legem. (69)
      
      The reply to the second question
      106. To sum up, therefore, the reply to the second question must be that the processing of personal data serves journalistic purposes
         within the meaning of Article 9 of the Data Protection Directive when it aims to communicate information and ideas on matters
         of public interest. Whether and, if so, to what extent the processing of the tax data which are the subject of the main proceedings
         serves journalistic purposes must be determined by the national court in the light of all the available objective information.
      
      C –    The third question – Article 17 of the Data Protection Directive 
      107. The third question from the national court is whether Article 17 of the Data Protection Directive, in conjunction with the
         principles and purpose of the Directive, is to be interpreted as meaning that the publication of data collected for journalistic
         purposes and its onward disclosure for processing for commercial purposes are contrary to that provision. 
      
      108. Article 17(1) of the Data Protection Directive regulates data-processing security. It states that the Member States are to
         provide that the controller must implement appropriate technical and organisational measures to protect personal data against
         accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where
         the processing involves the transmission of data over a network, and against all other unlawful forms of processing. Those
         measures must, having regard to the state of the art and the cost of their implementation, ensure a level of security appropriate
         to the risks represented by the processing and the nature of the data to be protected.
      
      109. Article 17(1) of the Data Protection Directive was implemented by Paragraph 32(1) of the Finnish Law on personal data, which
         is one of the few data protection provisions that relates also to the processing of personal data for journalistic purposes.
         The point of interest for the present case is that unauthorised and unlawful processing is to be prohibited. If those terms
         are to be understood as meaning that the processor must ensure that all the requirements of the Data Protection Directive
         are complied with, those requirements would also apply, notwithstanding the media privilege under Article 9 of the Directive,
         even where personal data are processed for journalistic purposes.
      
      110. However, this interpretation of Article 17(1) of the Data Protection Directive would not be consistent with the system of
         rules of the Directive. It would normally lead to unnecessary duplication of the requirements and, in the present case, would
         circumvent the manifest intention of the Finnish legislature to implement Article 9 of the Directive by exempting processing
         for journalistic purposes from those requirements. 
      
      111. Article 17(1) of the Data Protection Directive is to be correctly understood, in conformity with its heading ‘Security of
         processing’ and the explanatory statement for the Commission’s proposal, (70) as involving protection against external influences, particularly illegal access by third parties. This is indicated by the
         reference to the state of the art in the second sentence of Article 17(1). This is logical only in relation to technical security
         measures. Which processing operations are lawful has nothing to do with the state of the art. 
      
      112. Therefore the legality of data processing is not regulated by Article 17(1). It is dealt with in the other relevant rules
         of the Data Protection Directive.
      
      113. Possibly the interest of the national court also arises from the fact that Article 17(2) to (4) of the Data Protection Directive
         address data security where processing is carried out on behalf of another person, that is to say, where data are disclosed
         by the controller to a third party. In the present case, data are disclosed by Satakunnan Markkinapörssi Oy to Satamedia Oy.
         However, there are no material requirements under Article 17 for such disclosure. The rules for processing on behalf of another
         person are intended only to ensure that the requirements of Article 17(1) concerning security in processing are complied with
         also where processing is carried out on behalf of another person.
      
      114. In accordance with the proposal of most of the parties, therefore, the reply to the third question must be that Article 17
         of the Data Protection Directive contains no rule as to whether data collected for journalistic purposes may be published
         and disclosed for processing for commercial purposes. 
      
      D –    The fourth question – Processing of published data 
      115. The fourth question from the national court seeks to establish whether the Data Protection Directive can be interpreted as
         meaning that personal data files containing solely material that has been published in the media fall altogether outside its
         scope.
      
      116. The background to that question is Paragraph 2(4) of the Finnish Law on personal data, which provides that the law does not
         apply to personal data files containing solely data published by the media as such.
      
      117. As Estonia, Portugal and the Commission correctly point out, the Data Protection Directive contains no comparable provision.
         On the contrary, recitals 12 and 26 expressly state that the principles of protection must apply to any information concerning
         an identified or identifiable person.
      
      118. A general exception for published information would in particular render the purpose of data processing under Article 6(1)(b)
         of the Directive meaningless. Data could be used further for any purpose whatever after publication, irrespective of the purposes
         for which they were originally collected. 
      
      119. Finland, on the other hand, considers that the processing of published personal data is justified by the freedom of expression.
         Contrary to the Finnish submission, however, the fact that disclosure in the form of a text-messaging service also falls within
         the scope of the freedom of expression cannot be cited in support of that view. This consideration is of interest for examining
         Sweden’s argument that the abovementioned service meets the requirements of Article 9 of the Data Protection Directive and
         the corresponding Finnish provisions and is therefore covered by the media privilege. 
      
      120. However, the processing of published personal data is, in Finnish law, not subject to the requirements of Article 9 of the
         Directive at all. Consequently this gives rise to the question whether the freedom of expression extends to the unrestricted
         processing of such data. 
      
      121. Under Article 10(1) of the ECHR, the freedom of expression includes freedom to receive and impart information and ideas without
         interference by public authority. In so far as the processing of published personal data is necessary for that purpose, it
         falls within the scope of the freedom of expression. However, that freedom can and must be limited if the processing of data
         is precluded by the right to privacy. Consequently a general privilege in favour of such processing operations is out of the
         question. The question in each case is rather, which fundamental right is preponderant.
      
      122. In the case of published information which is, by definition, generally known, it should as a rule be presumed that the right
         to the protection of privacy is of less weight. However, the right to privacy may preclude the perpetuation and intensification
         of interference by means of the further processing of information, for instance, in the case of erroneous information, libel
         or information concerning intimate matters. 
      
      123. Exceptions to the requirements of the Data Protection Directive may also be based on Article 13. In that connection, protection
         of the rights and freedoms of others under Article 13(1)(g) comes into consideration. It would be conceivable that the freedom
         of expression in Finland includes the right to disclose published information without further restrictions by data protection.
         It must also be borne in mind that the processing of published information affects the right to privacy less than the processing
         of confidential information. To that extent, the Member States certainly have a broad margin of discretion.
      
      124. However, the margin of discretion cannot lead to the legitimation of manifestly disproportionate interference in the right
         to privacy by exceptions to data protection. For example, the further processing of personal information which is proved to
         be false cannot be justified by the fact that it has been published.
      
      125. In addition, Article 13 of the Data Protection Directive does not permit derogations from all the provisions of the Directive.
         The derogations are limited to the fundamental requirements of Article 6(1) concerning data processing and the right to information
         under Articles 10, 11(1) and 12, as well as the publicising of data-processing operations under Article 21.
      
      126. Therefore the reply to the fourth question must be that personal data files containing only media-published material as such
         fall within the scope of the Data Protection Directive.
      
      127. However, with regard to the fourth question, it must be remembered that the Data Protection Directive alone cannot create
         obligations of Satakunnan Markkinapörssi Oy and Satamedia Oy. For that, a basis is necessary in national law, which must be
         interpreted in conformity with the Directive, but not contra legem. (71)
      
      V –  Conclusion
      128. I therefore propose that the Court should reply to the request for a preliminary ruling as follows:
      
      (1)      An operation is to be regarded as the processing of personal data within the meaning of Article 3(1) of Directive 95/46/EC
         of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing
         of personal data and on the free movement of such data if the data of natural persons relating to their earned income, income
         from capital and wealth, as described in the reference for a preliminary ruling, are:
      
      (a)      collected from documents in the public domain held by the tax authorities and processed for publication,
      (b)      published alphabetically in a printed publication by income bracket and municipality in the form of extensive lists,
      (c)      disclosed onward on CD-ROM to be used for commercial purposes, or
      (d)      processed for the purposes of a text-messaging service whereby mobile phone users can, by indicating an individual’s name
         and home municipality and texting to a given number, receive in reply data on the earned income, income from capital and wealth
         of the individual indicated.
      
      (2)      The processing of personal data serves journalistic purposes within the meaning of Article 9 of Directive 95/46 within the
         meaning of that provision when it aims to communicate information and ideas on matters of public interest. Whether and, if
         so, to what extent the processing of the tax data which are the subject of the main proceedings serves journalistic purposes
         must be determined by the national court in the light of all the available objective information. 
      
      (3)      Article 17 of Directive 95/46 contains no rule as to whether data collected for journalistic purposes may be published and
         disclosed for processing for commercial purposes.
      
      (4)      Personal data files containing only media-published material as such fall within the scope of Directive 95/46.
      1 –	Original language: German.
      
      2 –	OJ 1995 L 281, p. 31, last amended by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29
         September 2003 adapting to Council Decision 1999/468/EC the provisions relating to committees which assist the Commission
         in the exercise of its implementing powers laid down in instruments subject to the procedure referred to in Article 251 of
         the EC Treaty (OJ 2003 L 284, p. 1).
      
      3 –	Order of 12 September 2007 in Case C‑73/07 Satakunnan Markkinapörssi and Satamedia [2007] ECR I‑7075, paragraph 8 et seq.
      
      4 –	For these concepts, see Walz, S., § 41, n. 1, in Simitis, S., Bundesdatenschutzgesetz, 6th edition, Baden-Baden, 2006, and Neunhoeffer, F., Das Presseprivileg im Datenschutzrecht, Tübingen, 2005.
      
      5 –	Joined Cases C‑238/99 P, C‑244/99 P, C‑245/99 P, C‑247/99P, C‑250/99 P to C‑252/99 P and C‑254/99 P Limburgse Vinyl Maatschappij and Others v Commission [2002] ECR I‑8375, paragraph 274, and Case C‑301/04 P Commission v SGL Carbon [2006] ECR I‑5915, paragraph 43.
      
      6 –	Case C‑260/89 ERT [1991] ECR I‑2925, paragraph 44; Case C‑288/89 CollectieveAntennevoorziening Gouda [1991] ECR I‑4007, paragraph 23; Case C‑353/89 Commission v Netherlands [1991] ECR I‑4069, paragraph 30; and Case C‑250/06 United Pan-Europe Communications Belgium and Others [2007] ECR I‑11135, paragraph 41.
      
      7 –	OJ 2000 C 364, p. 1. Adopted with amendments by the Proclamation of 12 December 2007 (OJ 2007 C 303, p. 1).
      
      8 –	See Collectieve Antennevoorziening Gouda and United Pan-Europe Communications Belgium and Others, both cited in footnote 6.
      
      9 –	Protocol to the EC Treaty (OJ 1997 C 340, p. 109).
      
      10 –	See, for example, Eur. Court H.R., Handyside, judgment of 7 December 1976, Series A no. 24, § 49; Müller and Others, judgment of 24 May 1988, Series A no. 133, § 33; Vogt, judgment of 26 September 1995, Series A no. 323, § 52; and Guja, no. 14277/04, not yet published in the official reports, § 69. See also Case C‑274/99 P Connolly v Commission [2001] ECR I‑1611, paragraph 39.
      
      11 –	Eur. Court H.R., Autronic AG, judgment of 22 May 1990, Series A no. 178, § 47, and Casado Coca, judgment of 24 February 1994, Series A no. 285-A, § 35 et seq. In this connection, the Commission rightly refers to the
         Opinion of Advocate General Fennelly in Case C‑376/98 Germany v Parliament andCouncil [2000] ECR I‑8419, point 153 et seq.
      
      12 –	Also Case C‑275/06 Promusicae [2008] ECR I‑271, paragraph 64.
      
      13 –	Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, paragraph 74.
      
      14 –	Eur. Court H.R., von Hannover, no. 59320/00, § 57  2004-VI, and the case-law cited there.
      
      15 –	Eur. Court H.R., von Hannover, cited in footnote 14, § 70.
      
      16 –	On freedom of expression, see Case C‑368/95 Familiapress [1997] ECR I‑3689, paragraph 26, and Case C‑112/00 Schmidberger [2003] ECR I‑5659, paragraph 79; see also Eur. Court H.R. judgments in Handyside, cited in footnote 10, § 48, and Observer and Guardian, no. 13585/88, § 59; on respect for private life, see Case C‑60/00 Carpenter [2002] ECR I‑6279, paragraph 42, and Österreichischer Rundfunk and Others, cited in footnote 13, paragraph 71; see also Eur. Court H.R. judgments in Leander, no. 9248/81, § 58, and Connors, no. 66746/01, not published in the official reports, § 81.
      
      17 –	See, for example, von Hannover, cited in footnote 14, § 61 et seq.
      
      18 –	See Case C‑101/01 Lindqvist [2003] ECR I‑12971, paragraph 82 et seq., and Promusicae, cited in footnote 12, paragraph 65 et seq.
      
      19 –	See Lindqvist, cited in footnote 18, paragraph 83 et seq., and Promusicae, cited in footnote 12, paragraph 67.
      
      20 –	See Lindqvist, cited in footnote 18, paragraph 87, and Promusicae, cited in footnote 12, paragraph 68.
      
      21 –	Cited in footnote 12, paragraph 61 et seq., particularly paragraph 68.
      
      22 –	Cited in footnote 13, paragraph 91 et seq.
      
      23 –	Cited in footnote 13, paragraph 86 et seq.
      
      24 –	Cited in footnote 16, paragraph 33.
      
      25 –	Cited in footnote 16, paragraph 34.
      
      26 –	Case C‑36/02 Omega [2004] ECR I‑9609, paragraph 37 et seq., and Case C‑244/06 Dynamic Medien [2008] ECR I‑505, paragraph 44; see also Case C‑243/01 Gambelli and Others [2003] ECR I‑13031, paragraph 63.
      
      27 –	Case C‑438/05 International Transport Workers’ Federation and Finnish Seamen’s Union [2007] ECR I‑10779, paragraph 85.
      
      28 –	Case C‑341/05 Laval un Partneri [2007] ECR I‑11767.
      
      29 –	International Transport Workers’ Federation and Finnish Seamen’s Union, cited in footnote 27.
      
      30 –	Case C‑265/95 Commission v France [1997] ECR I‑6959.
      
      31 –	Cited in footnote 16.
      
      32 –	Cited in footnote 16, paragraphs 82 and 93.
      
      33 –	Cited in footnote 16, paragraph 83 et seq.
      
      34 –	Opinions in Lindqvist, cited in footnote 18, point 35 et seq., and in Österreichischer Rundfunk and Others, cited in footnote 13, point 43 et seq.
      
      35 –	Österreichischer Rundfunk and Others, cited in footnote 13, paragraph 42.
      
      36 –	Case C‑60/05 WWF Italia and Others [2006] ECR I‑5083, paragraph 34, and Case C‑342/05 Commission v Finland [2007] ECR I‑4713, paragraph 25, both concerning exceptions to the protection of species; Case C‑169/00 Commission v Finland [2002] ECR I‑2433, paragraph 33, and the case-law cited, concerning value added tax; Case 189/87 Kalfelis [1988] ECR 5565, paragraph 19, and Case C‑98/06 Freeport [2007] ECR I‑8319, paragraph 35, both concerning jurisdiction in civil matters; and Case C‑435/06 C [2007] ECR I‑10141, paragraph 60, concerning jurisdiction in custody disputes.
      
      37 –	Lindqvist, cited in footnote 18, paragraph 83 et seq.; see also Promusicae, cited in footnote 12, paragraph 67, concerning Directive 2002/58/EC of the European Parliament and of the Council of 12
         July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector
         (OJ 2002 L 201, p. 37).
      
      38 –	For the interpretation of this provision, see Lindqvist, cited in footnote 18, paragraph 46 et seq.
      
      39 –	Accordingly the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal
         Data, signed in Strasbourg on 28 January 1981, ETS No 108, makes no provision for a special media privilege either, but provides
         for the adoption of exceptions for protecting the rights of others. See the notes to Article 9(b) of the convention, Explanatory
         Report, No 58, http://conventions.coe.int/Treaty/EN/Reports/Html/108.htm.
      
      40 –	Article 19 of the proposal for a Council directive on the protection of individuals with regard to the processing of personal
         data (COM(90) 314 final; OJ 1990 C 277, p. 3 (9)).
      
      41 –	See the opinion of the European Parliament of 11 March 1992 (OJ 1992 C 94, p. 173 [178]), the Commission’s amended proposal
         of 15 October 1992 (OJ 1992 C 311, p. 39 [45]), and finally the Common Position of the Council of 20 February 1995 (OJ 1995
         L 93, p. 1 [9]).
      
      42 –	Eur. Court H.R., Barthold, no. 8734/79, Series A, no. 90, § 58; Lingens, no. 9815/82, Series A, no. 103, § 44; Jersild, no. 15890/89, Series A, no. 298, § 31; Observer and Guardian, cited in footnote 16, § 59; von Hannover, cited in footnote 14, § 63, and Pedersen and Baadsgaard [GC], no. 49017/99, 2004-XI, § 71.
      
      43 –	Eur. Court H.R., News Verlags GmbH & Co. KG, no. 31457/96, 2000-I, § 54; Tammer, no. 41205/98, 2000-I, § 68; Editions Plon, no. 58148/00, 2004-IV, § 44; Stoll, no. 69698/01, § 118 et seq.; and Nikowitz and Verlagsgruppe News GmbH, no. 5266/03, § 25.
      
      44 –	Eur. Court H.R., News Verlags GmbH & Co. KG, cited in footnote 43, § 56.
      
      45 –	Eur. Court H.R., Editions Plon, cited in footnote 43, § 44.
      
      46 –	Eur. Court H.R., Stoll, cited in footnote 43, § 122, and Lingens, cited in footnote 42, § 42.  With reference to prominent persons in industry, see Eur. Court H.R., Tønsbergs Blad AS and Haukom, no. 510/04, not yet published in the official reports, § 87.
      
      47 –	Eur. Court H.R., von Hannover, cited in footnote 14, § 65, and News Verlags GmbH & Co. KG, cited in footnote 43, § 54.
      
      48 –	Eur. Court H.R., von Hannover, cited in footnote 14, § 51. For legitimate expectation in relation to data processing generally, see Eur. Court H.R., Halford, no. 20605/92, 1997-III, § 45; P.G. and J.H., no. 44787/98, 2001-IX, § 57; and Copland, no. 62617/00, not yet published in the official reports, § 42.
      
      49 –	Eur. Court H.R., no. 29183/95, 1999-I.
      
      50 –	Eur. Court H.R., Fressoz and Roire, cited in footnote 49, § 50.
      
      51 –	Eur. Court H.R., Fressoz and Roire, cited in footnote 49, § 53.
      
      52 –	Eur. Court H.R., Fressoz and Roire, cited in footnote 49, § 53.
      
      53 –	Eur. Court H.R., Fressoz and Roire, cited in footnote 49, § 50.
      
      54 –	Accordingly the European Court of Human Rights, in Goodwin, no. 28957/95, 1996-II, § 39, and Tillack, no. 20477/05, § 53, extended the protection of press freedom expressly to the protection of journalists’ sources.
      
      55 –	Accordingly the European Court of Human Rights refers, in Autronic AG , cited in footnote 11, § 47, to the fact that various judgments on press freedom concerned profit-making corporate bodies.
      
      56 –	See the order in Joined Cases C‑435/02 and C‑103/03 Springer [2004] ECR I‑8663, paragraph 47.
      
      57 –	That was the case in Eur. Court H.R., Verein gegen Tierfabriken, no. 24699/94, 2001-VI, concerning an advertisement against meat production, but not in Casado Coca, cited in footnote 11, concerning the prohibition of advertising by lawyers. See also Case C‑380/03 Germany v Parliament and Council [2006] ECR I‑11573, paragraph 156.
      
      58 –	On the choice of the legal basis for a Community measure, see Case 45/86 Commission v Council [1987] ECR 1493, paragraph 11, Case C‑300/89 Commission v Council [1991] ECR I‑2867, paragraph 10, and Case C‑440/05 Commission v Council [2007] ECR I‑9097, paragraph 61; on a finding of illegal objectives, see Case C‑255/02 Halifax and Others [2006] ECR I‑1609, paragraph 75, and Case C‑251/06 ING. AUER [2007] ECR I‑9689, paragraph 46; and on a finding of an intra-Community supply in the law of value added tax, see Case C‑409/04
         Teleos and Others [2007] ECR I‑7797, paragraph 39 et seq.
      
      59 –	Österreichischer Rundfunk and Others, cited in footnote 13, paragraph 89 et seq.
      
      60 –	Eur. Court H.R., Fressoz and Roire, cited in footnote 49, particularly § 53, where the position in domestic law only is discussed. See also the decision of
         the European Commission of Human Rights, Gedin, application no. 29189/95, concerning the naming of a person in a register of taxpayers in arrears.  
      
      61 –	Lindqvist, cited in footnote 18, paragraph 83, and Promusicae, cited in footnote 12, paragraph 67.
      
      62 –	Case 152/84 Marshall [1986] ECR 723, paragraph 48; Joined Cases C‑397/01 to C‑403/01 Pfeiffer and Others [2004] ECR I‑8835, paragraph 108; and Case C‑80/06 Carp [2007] ECR I‑4473, paragraph 20.
      
      63 –	Council Directive 2000/78/EC of 27 November 2000 establishing a general framework for equal treatment in employment and
         occupation (OJ 2000 L 303, p. 16).
      
      64 –	Case C‑144/04 Mangold [2005] ECR I‑9981, paragraph 75 et seq.
      
      65 –	Opinion in Case C‑321/05 Kofoed [2007] ECR I‑5795, point 67.
      
      66 –	Opinion of Advocate General Mázak in Case C‑411/05 Palacios de la Villa [2007] ECR I‑8531, point 133 et seq., and Opinion of Advocate General Ruiz-Jarabo Colomer in Joined Cases C‑55/07 and C‑56/07
         Michaeler and Others [2008] ECR I‑3135, point 21 et seq.
      
      67 –	Case 14/83 vonColson and Kamann [1984] ECR 1891, paragraph 26; Pfeiffer and Others, cited in footnote 62, paragraph 113; and Case C‑356/05 Farrell [2007] ECR I‑3067, paragraph 42.
      
      68 –	Lindqvist, cited in footnote 18, paragraph 87; Case C‑540/03 Parliament v Council [2006] ECR I‑5769, paragraph 105; and Promusicae, cited in footnote 12, paragraph 68.
      
      69 –	Case C‑105/03 Pupino [2005] ECR I‑5285, paragraphs 44 and 47, and Case C‑212/04 Adeneler and Others [2006] ECR I‑6057, paragraph 110.
      
      70 –	See the proposal for a directive of the Council on the protection of individuals with regard to the processing of personal
         data (COM(90) 314 final, p. 40), and the amended proposal for a directive of the Council on the protection of individuals
         with regard to the processing of personal data and on the free movement of such data (COM(92) 422, p. 28 et seq.).
      
      71 –	See point 99 et seq. above.