Proceedings brought by Tietosuojavaltuutettu.
Date: 2018-07-10
28


As regards the facts in the main proceedings, it must be recalled that in proceedings under Article 267 TFEU, only the court making the reference may define the factual context in which the questions which it asks arise or, at very least, explain the factual assumptions on which the questions are based. It follows that a party to the main proceedings cannot allege that certain factual premisses on which the arguments advanced by the other interested parties referred to in Article 23 of the Statute of the Court of Justice of the European Union are based, or the analysis of the Advocate General, are incorrect in order to justify the reopening of the oral procedure, on the basis of Article 83 of the Rules of Procedure (see, to that effect, judgment of 26 June 2008, Burda, C‑284/06, EU:C:2008:365, paragraphs 44, 45 and 47).
31


In that connection, it is solely for the national court hearing the case, which has the responsibility of taking the subsequent judicial decision, to determine, with regard to the particular aspects of the case, both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it refers to the Court. Consequently, where the questions put by national courts concern the interpretation of a provision of European Union law, the Court is, in principle, bound to give a ruling. The Court may refuse to rule on a question referred by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (see, to that effect, judgment of 27 June 2017, Congregación de Escuelas Pías Provincia Betania, C‑74/16, EU:C:2017:496, paragraphs 24 and 25 and the case-law cited).
35


In order to answer that question, it should be observed from the outset, as is clear from Article 1(1) and recital 10 of Directive 95/46, that that directive seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (judgments of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 66, and of 5 June 2018, Wirtshaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 26).
37


However, Article 3(2) lays down two exceptions to the scope of application of that directive which must be strictly interpreted (see, to that effect, judgments of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraph 29, and of 27 September 2017, Puškár, C‑73/16, EU:C:2017:725, paragraph 38). Furthermore, Directive 95/46 does not lay down any further limitation of its scope (judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 46).
38


First, as regards the exception in Article 3(2), first indent, of Directive 95/46, it has been held that the activities mentioned therein by way of exceptions are, in any event, activities of the State or of State authorities and are unrelated to fields in which individuals are active. Those activities are intended to define the scope of the exception provided for in that provision, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category (judgments of 6 November 2003, Lindqist, C‑101/01, EU:C:2003:596, paragraphs 43 and 44; of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 41; and of 27 September 2017, Puškár, C‑73/16, EU:C:2017:725, paragraphs 36 and 37).
40


Second, as regards the exception in Article 3(2), second indent, of Directive 95/46, that provision does not exclude from its scope data processing carried out in relation simply to an activity which is simply a personal or household activity, but only data processing carried out in relation to an activity that is ‘purely’ personal or household in nature (see, to that effect, judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraphs 30).
41


The words ‘personal or household’, within the meaning of that provision, refer to the activity of the person processing the personal data and not to the person whose data are processed (see, to that effect, judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraphs 31 and 33).
42


As the Court held, Article 3(2), second indent, of Directive 95/46 must be interpreted as covering only activities that are carried out in the context of the private or family life of individuals. In that connection, an activity cannot be regarded as being purely personal or domestic where its purpose is to make the data collected accessible to an unrestricted number of people or where that activity extends, even partially, to a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner (see, to that effect, judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 47; of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 44; and of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraphs 31 and 33).
47


The Charter adopts a broad understanding of the concept of ‘religion’ in that provision covering both the forum internum, that is the fact of having a belief, and the forum externum, that is the manifestation of religious faith in public (judgment of 29 May 2018, Liga van Moskeeën en Islamitische Organisaties Provincie Antwerpen VZW and Others, C‑426/16, EU:C:2018:335, paragraph 44 and the case-law cited).
65


As expressly provided in Article 2(d) of Directive 95/46, the concept of ‘controller’ refers to the natural or legal person who ‘alone or jointly with others determines the purposes and means of the processing of personal data’. Therefore, that concept does not necessarily refer to a single natural or legal person and may concern several actors taking part in that processing, with each of them then being subject to the applicable data protection provisions (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 29).
66


The objective of that provision being to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of the persons concerned, the existence of joint responsibility does not necessarily imply equal responsibility of the various operators engaged in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, so that the level of responsibility of each of them must be assessed with regard to all the relevant circumstances of the particular case (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraphs 28, 43 and 44).
68


However, a natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller within the meaning of Article 2(d) of Directive 95/46.
69


Furthermore, the joint responsibility of several actors for the same processing, under that provision, does not require each of them to have access to the personal data concerned (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 38).
74


That finding cannot be called into question by the principle of organisational autonomy of religious communities which derives from Article 17 TFEU. The obligation for every person to comply with the rules of EU law on the protection of personal data cannot be regarded as an interference in the organisational autonomy of those communities (see, to that effect, judgment of 17 April 2018, Egenberger, C‑414/16, EU:C:2018:257, paragraph 58).