Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy.
Date: 2008-12-16
11. Paragraph 10(1) of the Constitution (Perustuslaki (731/1999)) of 11 June 1999 states:
‘The right to privacy, honour and the inviolability of the home of every person shall be guaranteed. More detailed provisions on the protection of personal data shall be laid down by law.’
35. It must be held that the data to which this question relates, which comprise the surname and given name of certain natural persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned income, constitute personal data within the meaning of Article 2(a) of the directive, since they constitute ‘information relating to an identified or identifiable natural person’ (see also Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64).
41. Those activities, which are mentioned by way of example in the first indent of Article 3(2) are, in any event, activities of the State or of State authorities unrelated to the fields of activity of individuals. They are intended to define the scope of the exception provided for there, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category ( ejusdem generis ) (see Case C-101/01 Lindqvist  [2003] ECR I-12971, paragraphs 43 and 44).
42. Activities involving the processing of personal data of the kind referred to at points (c) and (d) of the first question concern the activities of private companies. Those activities do not fall in any way within a framework established by the public authorities that relates to public security. Consequently, such activities cannot be assimilated to those covered by Article 3(2) of the directive (see, to that effect, Joined Cases C-317/04 and C-318/04 Parliament v Council [2006] ECR I‑4721, paragraph 58).
44. It follows that the latter exception must be interpreted as relating only to activities which are carried out in the course of private or family life of individuals (see Lindqvist , paragraph 47). That clearly does not apply to the activities of Markkinapörssi and Satamedia, the purpose of which is to make the data collected accessible to an unrestricted number of people.
46. Moreover, it should be pointed out that the directive does not lay down any further limitation of its scope of application.
48. Lastly, it must be held that a general derogation from the application of the directive in respect of published information would largely deprive the directive of its effect. It would be sufficient for the Member States to publish data in order for those data to cease to enjoy the protection afforded by the directive.
49. The answer to the fourth question should therefore be that activities involving the processing of personal data such as those referred to at points (c) and (d) of the first question and relating to personal data files which contain solely, and in unaltered form, material that has already been published in the media, fall within the scope of application of the directive.
The second question
51. It must be observed, as a preliminary point, that, according to settled case-law, the provisions of a directive must be interpreted in the light of the aims pursued by the directive and the system it establishes (see, to that effect, Case C-265/07 Caffaro  [2008] ECR I-0000, paragraph 14).
52. In that regard, it is not in dispute that, as is apparent from Article 1 of the directive, its objective is that the Member States should, while permitting the free flow of personal data, protect the fundamental rights and freedoms of natural persons and, in particular, their right to privacy, with respect to the processing of personal data.
53. That objective cannot, however, be pursued without having regard to the fact that those fundamental rights must, to some degree, be reconciled with the fundamental right to freedom of expression.
54. Article 9 of the directive refers to such a reconciliation. As is apparent, in particular, from recital 37 in the preamble to the directive, the object of Article 9 is to reconcile two fundamental rights: the protection of privacy and freedom of expression. The obligation to do so lies on the Member States.
55. In order to reconcile those two ‘fundamental rights’ for the purposes of the directive, the Member States are required to provide for a number of derogations or limitations in relation to the protection of data and, therefore, in relation to the fundamental right to privacy, specified in Chapters II, IV and VI of the directive. Those derogations must be made solely for journalistic purposes or the purpose of artistic or literary expression, which fall within the scope of the fundamental right to freedom of expression, in so far as it is apparent that they are necessary in order to reconcile the right to privacy with the rules governing freedom of expression.
56. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary, first, to interpret notions relating to that freedom, such as journalism, broadly. Secondly, and in order to achieve a balance between the two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data provided for in the chapters of the directive referred to above must apply only in so far as is strictly necessary.
58. First, as the Advocate General pointed out at point 65 of her Opinion and as is apparent from the legislative history of the directive, the exemptions and derogations provided for in Article 9 of the directive apply not only to media undertakings but also to every person engaged in journalism.
60. Thirdly, account must be taken of the evolution and proliferation of methods of communication and the dissemination of information. As was mentioned by the Swedish Government in particular, the medium which is used to transmit the processed data, whether it be classic in nature, such as paper or radio waves, or electronic, such as the internet, is not determinative as to whether an activity is undertaken ‘solely for journalistic purposes’.
61. It follows from all of the above that activities such as those involved in the main proceedings, relating to data from documents which are in the public domain under national legislation, may be classified as ‘journalistic activities’ if their object is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They are not limited to media undertakings and may be undertaken for profit-making purposes.
62. The answer to the second question should therefore be that Article 9 of the directive is to be interpreted as meaning that the activities referred to at points (a) to (d) of the first question, relating to data from documents which are in the public domain under national legislation, must be considered as activities involving the processing of personal data carried out ‘solely for journalistic purposes’, within the meaning of that provision, if the sole object of those activities is the disclosure to the public of information, opinions or ideas. Whether that is the case is a matter for the national court to determine.
The third question