CELEX: 62007CJ0073
Language: en
Date: 2008-12-16
Title: Judgment of the Court (Grand Chamber) of 16 December 2008.#Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy.#Reference for a preliminary ruling: Korkein hallinto-oikeus - Finland.#Directive 95/46/EC - Scope - Processing and flow of tax data of a personal nature - Protection of natural persons - Freedom of expression.#Case C-73/07.

Case C-73/07
      Tietosuojavaltuutettu
      v
      Satakunnan Markkinapörssi Oy
      and
      Satamedia Oy
      (Reference for a preliminary ruling from the Korkein hallinto-oikeus)
      (Directive 95/46/EC – Scope – Processing and flow of tax data of a personal nature – Protection of natural persons – Freedom of expression)
      Summary of the Judgment
      1.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46
      (European Parliament and Council Directive 95/46, Art. 3(1))
      2.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46
      (European Parliament and Council Directive 95/46, Art. 9)
      3.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46
      (European Parliament and Council Directive 95/46)
      1.        Article 3(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the
         free movement of such data, which governs the scope of application of the directive, is to be interpreted as meaning that
         an activity in which data on the earned and unearned income and the assets of natural persons are:
      
      – collected from documents in the public domain held by the tax authorities and processed for publication,
      – published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
      – transferred onward on CD-ROM to be used for commercial purposes, and,
      – processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
         details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the
         earned and unearned income and assets of that person,
      
      must be considered as the ‘processing of personal data’ within the meaning of that provision.
      (see para. 37, operative part 1)
      2.        Article 9 of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free
         movement of such data, which governs the relationship between the protection of such data and freedom of expression, is to
         be interpreted as meaning that an activity in which data on the earned and unearned income and the assets of natural persons
         are:
      
      – collected from documents in the public domain held by the tax authorities and processed for publication,
      – published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
      – transferred onward on CD-ROM to be used for commercial purposes, and,
      – processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
         details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the
         earned and unearned income and assets of that person, 
      
      must be considered as activities involving the processing of personal data carried out ‘solely for journalistic purposes’,
         within the meaning of that provision, if the sole object of those activities is the disclosure to the public, irrespective
         of the medium which is used to transmit them, of information, opinions or ideas. Whether that is the case is a matter for
         the national court to determine.
      
      In any event, those activities are not limited to media undertakings and may be undertaken for profit-making purposes.
       (see paras 61-62, operative part 2)
      3.        The scope of application of Directive 95/46 on the protection of individuals with regard to the processing of personal data
         and on the free movement of such data extends to the processing of personal data which consists in transferring onward on
         CD-ROM, in order for them to be used for commercial purposes, data on the earned and unearned income and the assets of natural
         persons which has been collected from documents in the public domain held by the tax authorities and processed for publication
         and which has already been published in the media. The scope of application of the directive also extends to the processing
         of such data for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
         details of an individual’s name and municipality of residence to a given number, receive those data.
      
      (see para. 49, operative part 3)
JUDGMENT OF THE COURT (Grand Chamber)
      16 December 2008 (*)
      
      (Directive 95/46/EC – Scope – Processing and flow of tax data of a personal nature – Protection of natural persons – Freedom of expression)
      In Case C‑73/07,
      REFERENCE for a preliminary ruling under Article 234 EC from the Korkein hallinto-oikeus (Finland), made by decision of 8
         February 2007, received at the Court on 12 February 2007, in the proceedings
      
      Tietosuojavaltuutettu
      v
      Satakunnan Markkinapörssi Oy,
      Satamedia Oy,
      THE COURT (Grand Chamber),
      composed of V. Skouris, President, P. Jann, C.W.A. Timmermans, A. Rosas, K. Lenaerts and A. Ó Caoimh, Presidents of Chambers,
         P. Kūris, E. Juhász, G. Arestis, A. Borg Barthet, J. Klučka, U. Lõhmus and E. Levits (Rapporteur), Judges,
      
      Advocate General: J. Kokott,
      Registrar: C. Strömholm, Administrator,
      having regard to the written procedure and further to the hearing on 12 February 2008,
      after considering the observations submitted on behalf of:
      –        Satakunnan Markkinapörssi Oy and Satamedia Oy, by P. Vainio, asianajaja,
      –        the Finnish Government, by J. Heliskoski, acting as Agent,
      –        the Estonian Government, by L. Uibo, acting as Agent,
      –        the Portuguese Government, by L.I. Fernandes and C. Vieira Guerra, acting as Agents,
      –        the Swedish Government, by A. Falk and K. Petkovska, acting as Agents,
      –        the Commission of the European Communities, by C. Docksey and P. Aalto, acting as Agents,
      after hearing the Advocate General at the sitting on 8 May 2008,
      gives the following
      Judgment
      1        This reference for a preliminary ruling relates to the interpretation of Directive 95/46/EC of the European Parliament and
         of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the
         free movement of such data (OJ 1995 L 281, p. 31) (‘the directive’).
      
      2        The reference was made in proceedings between the Tietosuojavaltuutettu (Data Protection Ombudsman) and the Tietosuojalautakunta
         (Data Protection Board) relating to activities involving the processing of personal data undertaken by Satakunnan Markkinapörssi
         Oy (‘Markkinapörssi’) and Satamedia Oy (‘Satamedia’).
      
       Legal context
       Community legislation 
      3        As is apparent from Article 1(1) of the directive, its objective is to protect the fundamental rights and freedoms of natural
         persons, and, in particular, their right to privacy with respect to the processing of personal data.
      
      4        Article 1(2) of the directive states:
      
      ‘Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected
         with the protection afforded under paragraph 1.’
      
      5        Article 2 of the directive, entitled ‘Definitions’, provides:
      
      ‘For the purposes of this Directive:
      (a)       “personal data” shall mean any information relating to an identified or identifiable natural  person (“data subject”); an
         identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification
         number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
      
      (b)      “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal
         data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval,
         consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination,  blocking,
         erasure or destruction;
      
      (c)
            “personal data filing system” (“filing system”) shall mean any structured set of personal data which are accessible according
         to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
      
      …’
      6        Article 3 of the directive defines its scope of application in the following manner:
      
      ‘1.      This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise
         than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
      
      2.      This Directive shall not apply to the processing of personal data:
      –        in the course of an activity which falls outside the scope of Community law, such as those  provided for by Titles V and VI
         of the Treaty on European Union and in any case to processing  operations concerning public security, defence, State security
         (including the economic well-being of the State when the processing operation relates to State security matters) and the activities
         of  the State in areas of criminal law,
      
      –        by a natural person in the course of a purely personal or household activity.’
      7        The relationship between the protection of personal data and freedom of expression is governed by Article 9 of the directive,
         entitled ‘Processing of personal data and freedom of expression’, in the following terms:
      
      ‘Member States shall provide for  exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI
         for the  processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression
         only if they are necessary to reconcile the right to privacy with the rules  governing freedom of expression.’
      
      8        In that connection, recital 37 in the preamble to the directive is worded as follows:
      
      ‘Whereas the processing of personal data for purposes of journalism or for purposes of literary or artistic expression, in
         particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive
         in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of [expression] and notably
         the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the
         Protection of Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions and derogations
         necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing,
         measures on the transfer of data to third countries and the power of the supervisory authority; whereas this should not, however,
         lead Member States to lay down exemptions from the measures to ensure security of processing; whereas at least the supervisory
         authority responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report
         or to refer matters to the judicial authorities.’ 
      
      9        Article 13 of the directive, entitled ‘Exemptions and restrictions’, states:
      
      ‘1.      Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles
         6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard:
      
      (a)      national security;
      …’ 
      10      Article 17 of the directive, entitled ‘Security of processing’, provides: 
      
      ‘1.      Member States shall provide that the controller must implement appropriate technical and organisational measures to protect
         personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access,
         in particular where the processing involves the transmission of data over a network, and  against all other unlawful forms
         of processing. 
      
      Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security
         appropriate to the risks represented by the processing and the nature of the data to be protected.
      
      2.      The Member States shall provide that the controller must, where processing is carried out on his behalf, choose a processor
         providing sufficient guarantees in respect of the technical security measures and organisational measures governing the processing
         to be carried out, and must ensure compliance with those measures.
      
      …’
       National legislation
      11      Paragraph 10(1) of the Constitution (Perustuslaki (731/1999)) of 11 June 1999 states: 
      
      ‘The right to privacy, honour and the inviolability of the home of every person shall be guaranteed. More detailed provisions
         on the protection of personal data shall be laid down by law.’
      
      12      Paragraph 12 of the Constitution provides:
      
      ‘Everyone shall have the right to freedom of expression. Freedom of expression entails the right to express oneself and to
         disseminate and receive information, opinions and other communications without prior hindrance. More detailed provisions relating
         to the exercise of the right to freedom of expression shall be laid down by law. …’
      
      Documents and other records in the possession of the authorities shall be in the public domain, unless specifically restricted
         by law for compelling reasons. Every person shall have the right of access to public documents and records.’
      
      13      The Law on personal data (Henkilötietolaki (523/1999)) of 22 April 1999, which transposed the directive into national law,
         applies to the processing of those data (Paragraph 2(1)), apart from personal data files which contain solely, and in unaltered
         form, material that has been published in the media (Paragraph 2(4)). It applies only in part to the processing of personal
         data for journalistic purposes and for the purpose of artistic or literary expression (Paragraph 2(5)). 
      
      14      Paragraph 32 of the Law on personal data provides that the controller is to take all technical and organisational measures
         necessary in order to protect personal data against unauthorised access to those data, and their accidental or unlawful destruction,
         alteration, disclosure or transfer, together with any other unlawful processing of those data. 
      
      15      The Law on public access in relation to official activities (Laki viranomaisten toiminnan julkisuudesta (621/1999)) of 21
         May 1999 also governs access to information.
      
      16      Paragraph 1(1) of the Law on public access in relation to official activities states that the general principle is that documents
         covered by that law are to be in the public domain. 
      
      17      Paragraph 9 of that law provides that every person is to have the right of access to a public document held by the public
         authorities. 
      
      18      Paragraph 16(1) of that law lays down the detailed rules governing access to a document of that kind. It provides that the
         public authorities are to explain the contents of the document orally, make the document available in their offices where
         it may be studied, copied or listened to, or issue a copy or a print-out of the document concerned. 
      
      19      Paragraph 16(3) of that law specifies the circumstances in which data in files containing personal data kept by the public
         authorities may be disclosed:
      
      ‘A file containing personal data may be disclosed in the form of a print-out, or those data may be disclosed in electronic
         form, unless provided otherwise by law, if the recipient is authorised to store and use such data by virtue of the provisions
         governing the protection of personal data. However, access to personal data for the purposes of direct marketing, market surveys
         or market research shall not be permitted unless specifically provided for by law or if the data subject has given his consent.’
      
      20      The national court states that the provisions of the Law on the public disclosure and confidentiality of tax information (Laki
         verotustietojen julkisuudesta ja salassapidosta (1346/1999)) of 30 December 1999 are to prevail over those of the Law on personal
         data and the Law on public access in relation to official activities.
      
      21      Paragraph 2 of the Law on the public disclosure and confidentiality of tax information provides that the provisions of the
         Law on public access in relation to official activities and the Law on personal data are to apply to documents and information
         relating to tax matters, save as may be otherwise provided in a legislative measure. 
      
      22      Paragraph 3 of the Law on the public disclosure and confidentiality of tax information states:
      
      ‘Information relating to tax matters shall be in the public domain in accordance with the detailed rules laid down in this
         law. 
      
      Every person shall have the right to obtain access to a document relating to tax matters which is in the public domain and
         held by the tax authorities, in accordance with the detailed rules laid down in the Law on public access in relation to official
         activities, subject to the exceptions laid down in this law.’
      
      23      Paragraph 5(1) of the Law on the public disclosure and confidentiality of tax information provides that details of the taxpayer’s
         name, his date of birth and his municipality of residence, as set out in his annual tax return, are to be in the public domain.
         The following information is also in the public domain:
      
      ‘1.      Earned income for the purposes of national taxation;
      2.      Unearned income and income from property for the purposes of national taxation;
      3.      Earned income for the purposes of municipal taxation;
      4.      Taxes on income and property, municipal taxes and the total amount of taxes and charges levied.
      …’
      24      Lastly, Paragraph 8 of Chapter 24 of the Criminal Code (Rikoslaki), in the version brought into force by Law 531/2000, imposes
         penalties in respect of the disclosure of information which infringes an individual’s right to privacy. Under those provisions,
         it is an offence to disseminate, through the media or otherwise, any information, innuendo or images relating to the private
         life of another person where to do so would be liable to cause harm or suffering to the person concerned or to bring that
         person into disrepute. 
      
       The dispute in the main proceedings and the questions referred 
      25      For several years, Markkinapörssi has collected public data from the Finnish tax authorities for the purposes of publishing
         extracts from those data in the regional editions of the Veropörssi newspaper each year. 
      
      26      The information contained in those publications comprises the surname and given name of approximately 1.2 million natural
         persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned
         income and details relating to wealth tax levied on them. That information is set out in the form of an alphabetical list
         and organised according to municipality and income bracket. 
      
      27      According to the order for reference, the Veropörssi newspaper carries a statement that the personal data disclosed may be removed on request and without charge. 
      
      28      While that newspaper also contains articles, summaries and advertisements, its main purpose is to publish personal tax information.
         
      
      29      Markkinapörssi transferred personal data published in the Veropörssi newspaper, in the form of CD-ROM discs, to Satamedia, which is owned by the same shareholders, with a view to those data
         being disseminated by a text-messaging system. In that connection, those companies signed an agreement with a mobile telephony
         company which put in place, on Satamedia’s behalf, a text-messaging service allowing mobile telephone users to receive information
         published in the Veropörssi newspaper on their telephone, for a charge of approximately EUR 2. Personal data are removed from that service on request.
         
      
      30      The Tietosuojavaltuutettu and the Tietosuojalautakunta, who are the Finnish authorities responsible for data protection, supervise
         the processing of personal data and have the regulatory powers laid down in the Law on personal data. 
      
      31      Following complaints from individuals alleging infringement of their right to privacy, on 10 March 2004, the Tietosuojavaltuutettu
         responsible for investigating the activities of Markkinapörssi and Satamedia requested the Tietosuojalautakunta to prohibit
         the latter from carrying on the personal data processing activities at issue.
      
      32      That request having been rejected by the Tietosuojalautakunta, the Tietosuojavaltuutettu brought proceedings before the Helsingin
         hallinto-oikeus (Administrative Court, Helsinki), which also rejected his application. The Tietosuojavaltuutettu then brought
         an appeal before the Korkein hallinto-oikeus (Supreme Administrative Court). 
      
      33      The national court emphasises that the appeal brought by the Tietosuojavaltuutettu does not concern the transfer of information
         by the Finnish authorities. It also states that the public nature of the tax data in question is not at issue. On the other
         hand, it has concerns as regards the subsequent processing of those data.
      
      34      In those circumstances, it decided to stay the proceedings and to refer the following questions to the Court for a preliminary
         ruling: 
      
      ‘(1)  Can an activity in which data relating to the earned and unearned income and assets of natural persons are:
      (a)      collected from documents in the public domain held by the tax authorities and processed for publication,
      (b)      published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
      (c)      transferred onward on CD-ROM to be used for commercial purposes, and
      (d)      processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
         details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the
         earned and unearned income and assets of that person,
      
      be regarded as the processing of personal data within the meaning of Article 3(1) of [the directive]?
      (2)      Is [the directive] to be interpreted as meaning that the various activities listed in Question 1(a) to (d) can be regarded
         as the processing of personal data carried out solely for journalistic purposes within the meaning of Article 9 of the directive,
         having regard to the fact that data on over one million taxpayers have been collected from information which is in the public
         domain under national legislation on the right of public access to information? Does the fact that publication of those data
         is the principal aim of the operation have any bearing on the assessment in this case?
      
      (3)      Is Article 17 of [the directive] to be interpreted in conjunction with the principles and purpose of the directive as precluding
         the publication of data collected for journalistic purposes and its onward transfer for commercial purposes?
      
      (4)      Is [the directive] to be interpreted as meaning that personal data files containing, solely and in unaltered form, material
         that has already been published in the media fall altogether outside its scope?’
      
       The questions referred
       The first question
      35      It must be held that the data to which this question relates, which comprise the surname and given name of certain natural
         persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned
         income, constitute personal data within the meaning of Article 2(a) of the directive, since they constitute ‘information relating
         to an identified or identifiable natural person’ (see also Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64).
      
      36      It is sufficient to hold, next, that it is clear from the wording itself of the definition set out in Article 2(b) of the
         directive that the activity to which the question relates involves the ‘processing of personal data’ within the meaning of
         that provision.
      
      37      Consequently, the answer to the first question must be that Article 3(1) of the directive is to be interpreted as meaning
         that an activity in which data on the earned and unearned income and the assets of natural persons are:
      
      –        collected from documents in the public domain held by the tax authorities and processed for publication,
      –        published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
      –        transferred onward on CD-ROM to be used for commercial purposes, and
      –        processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
         details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the
         earned and unearned income and assets of that person,
      
      must be considered as the ‘processing of personal data’ within the meaning of that provision. 
       The fourth question
      38      By its fourth question, which should be examined next, the national court asks, in essence, whether activities involving the
         processing of personal data such as those referred to at points (c) and (d) of the first question and relating to personal
         data files which contain solely, and in unaltered form, material that has already been published in the media, fall within
         the scope of application of the directive.
      
      39      By virtue of Article 3(2) of the directive, the directive does not apply to the processing of personal data in two situations.
         
      
      40      The first situation involves the processing of personal data undertaken in the course of an activity which falls outside the
         scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and, in any case, to
         processing operations concerning public security, defence, State security (including the economic well-being of the State
         when the processing operation relates to State security matters) and the activities of the State in areas of criminal law.
      
      41      Those activities, which are mentioned by way of example in the first indent of Article 3(2) are, in any event, activities
         of the State or of State authorities unrelated to the fields of activity of individuals. They are intended to define the scope
         of the exception provided for there, with the result that that exception applies only to the activities which are expressly
         listed there or which can be classified in the same category (ejusdem generis) (see Case C-101/01 Lindqvist [2003] ECR I-12971, paragraphs 43 and 44).
      
      42      Activities involving the processing of personal data of the kind referred to at points (c) and (d) of the first question concern
         the activities of private companies. Those activities do not fall in any way within a framework established by the public
         authorities that relates to public security. Consequently, such activities cannot be assimilated to those covered by Article
         3(2) of the directive (see, to that effect, Joined Cases C-317/04 and C-318/04 Parliament v Council [2006] ECR I‑4721, paragraph 58). 
      
      43      As regards the second situation, which is covered by the second indent of that provision, recital 12 in the preamble to the
         directive – relating to that exception – mentions as examples of data processing carried out by a natural person in the course
         of a purely personal or household activity, correspondence and the holding of records of addresses.
      
      44      It follows that the latter exception must be interpreted as relating only to activities which are carried out in the course
         of private or family life of individuals (see Lindqvist, paragraph 47). That clearly does not apply to the activities of Markkinapörssi and Satamedia, the purpose of which is to
         make the data collected accessible to an unrestricted number of people. 
      
      45      It must therefore be held that activities involving the processing of personal data of the kind referred to at points (c)
         and (d) of the first question are not covered by any of the situations referred to in Article 3(2) of the directive.
      
      46      Moreover, it should be pointed out that the directive does not lay down any further limitation of its scope of application.
      
      47      In that regard, the Advocate General observes at point 125 of her Opinion that Article 13 of the directive permits derogations
         from its provisions only in certain cases, which do not extend to the provisions of Article 3.
      
      48      Lastly, it must be held that a general derogation from the application of the directive in respect of published information
         would largely deprive the directive of its effect. It would be sufficient for the Member States to publish data in order for
         those data to cease to enjoy the protection afforded by the directive.
      
      49      The answer to the fourth question should therefore be that activities involving the processing of personal data such as those
         referred to at points (c) and (d) of the first question and relating to personal data files which contain solely, and in unaltered
         form, material that has already been published in the media, fall within the scope of application of the directive. 
      
       The second question
      50      By its second question, the national court asks, in essence, whether Article 9 of the directive should be interpreted as meaning
         that the activities referred to at points (a) to (d) of the first question, relating to data from documents which are in the
         public domain under national legislation, must be considered as activities involving the processing of personal data carried
         out solely for journalistic purposes. The national court states that it seeks clarification as to whether the fact that the
         principal aim of those activities is the publication of the data in question is relevant to the determination of that issue.
      
      51      It must be observed, as a preliminary point, that, according to settled case-law, the provisions of a directive must be interpreted
         in the light of the aims pursued by the directive and the system it establishes (see, to that effect, Case C-265/07 Caffaro [2008] ECR I-0000, paragraph 14).
      
      52      In that regard, it is not in dispute that, as is apparent from Article 1 of the directive, its objective is that the Member
         States should, while permitting the free flow of personal data, protect the fundamental rights and freedoms of natural persons
         and, in particular, their right to privacy, with respect to the processing of personal data.
      
      53      That objective cannot, however, be pursued without having regard to the fact that those fundamental rights must, to some degree,
         be reconciled with the fundamental right to freedom of expression.
      
      54      Article 9 of the directive refers to such a reconciliation. As is apparent, in particular, from recital 37 in the preamble
         to the directive, the object of Article 9 is to reconcile two fundamental rights: the protection of privacy and freedom of
         expression. The obligation to do so lies on the Member States.
      
      55      In order to reconcile those two ‘fundamental rights’ for the purposes of the directive, the Member States are required to
         provide for a number of derogations or limitations in relation to the protection of data and, therefore, in relation to the
         fundamental right to privacy, specified in Chapters II, IV and VI of the directive. Those derogations must be made solely
         for journalistic purposes or the purpose of artistic or literary expression, which fall within the scope of the fundamental
         right to freedom of expression, in so far as it is apparent that they are necessary in order to reconcile the right to privacy
         with the rules governing freedom of expression. 
      
      56      In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary,
         first, to interpret notions relating to that freedom, such as journalism, broadly. Secondly, and in order to achieve a balance
         between the two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations
         in relation to the protection of data provided for in the chapters of the directive referred to above must apply only in so
         far as is strictly necessary. 
      
      57      In that context, the following points are relevant.
      
      58      First, as the Advocate General pointed out at point 65 of her Opinion and as is apparent from the legislative history of the
         directive, the exemptions and derogations provided for in Article 9 of the directive apply not only to media undertakings
         but also to every person engaged in journalism.
      
      59      Secondly, the fact that the publication of data within the public domain is done for profit-making purposes does not, prima
         facie, preclude such publication being considered as an activity undertaken ‘solely for journalistic purposes’. As Markkinapörssi
         and Satamedia state in their observations and as the Advocate General noted at point 82 of her Opinion, every undertaking
         will seek to generate a profit from its activities. A degree of commercial success may even be essential to professional journalistic
         activity.
      
      60      Thirdly, account must be taken of the evolution and proliferation of methods of communication and the dissemination of information.
         As was mentioned by the Swedish Government in particular, the medium which is used to transmit the processed data, whether
         it be classic in nature, such as paper or radio waves, or electronic, such as the internet, is not determinative as to whether
         an activity is undertaken ‘solely for journalistic purposes’. 
      
      61      It follows from all of the above that activities such as those involved in the main proceedings, relating to data from documents
         which are in the public domain under national legislation, may be classified as ‘journalistic activities’ if their object
         is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them.
         They are not limited to media undertakings and may be undertaken for profit-making purposes.
      
      62      The answer to the second question should therefore be that Article 9 of the directive is to be interpreted as meaning that
         the activities referred to at points (a) to (d) of the first question, relating to data from documents which are in the public
         domain under national legislation, must be considered as activities involving the processing of personal data carried out
         ‘solely for journalistic purposes’, within the meaning of that provision, if the sole object of those activities is the disclosure
         to the public of information, opinions or ideas. Whether that is the case is a matter for the national court to determine.
      
      The third question
      63      By its third question, the national court asks, in essence, whether Article 17 of the directive should be interpreted as meaning
         that it precludes the publication of data which have been collected for journalistic purposes and their onward transfer for
         commercial purposes.
      
      64      Having regard to the answer given to the second question, there is no need to reply to this question. 
      
       Costs
      65      Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court,
         the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs
         of those parties, are not recoverable.
      
      On those grounds, the Court (Grand Chamber) hereby rules:
      1.      Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals
            with regard to the processing of personal data and on the free movement of such data is to be interpreted as meaning that
            an activity in which data on the earned and unearned income and the assets of natural persons are:
      –        collected from documents in the public domain held by the tax authorities and processed for publication,
      –        published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
      –        transferred onward on CD-ROM to be used for commercial purposes, and 
      –        processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing
            details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the
            earned and unearned income and assets of that person, 
      must be considered as the ‘processing of personal data’ within the meaning of that provision.
      2.      Article 9 of Directive 95/46 is to be interpreted as meaning that the activities referred to at points (a) to (d) of the first
            question, relating to data from documents which are in the public domain under national legislation, must be considered as
            activities involving the processing of personal data carried out ‘solely for journalistic purposes’, within the meaning of
            that provision, if the sole object of those activities is the disclosure to the public of information, opinions or ideas.
            Whether that is the case is a matter for the national court to determine. 
      3.      Activities involving the processing of personal data such as those referred to at points (c) and (d) of the first question
            and relating to personal data files which contain solely, and in unaltered form, material that has already been published
            in the media, fall within the scope of application of Directive 95/46. 
      [Signatures]
      * Language of the case: Finnish.