Criminal proceedings against Bodil Lindqvist.
Date: 2003-11-06
24. The term   " personal data"  used in Article 3(1) of Directive 95/46 covers, according to the definition in Article 2(a) thereof,   " any information relating to an identified or identifiable natural person" .  The term undoubtedly covers the name of a person in conjunction with his telephone coordinates or information about his working conditions or hobbies.
25. According to the definition in Article 2(b) of Directive 95/46, the term   " processing"  of such data used in Article 3(1) covers   " any operation or set of operations which is performed upon personal data, whether or not by automatic means" .  That provision gives several examples of such operations, including disclosure by transmission, dissemination or otherwise making data available.  It follows that the operation of loading personal data on an internet page must be considered to be such processing.
26. It remains to be determined whether such processing is   " wholly or partly by automatic means" .  In that connection, placing information on an internet page entails, under current technical and computer procedures, the operation of loading that page onto a server and the operations necessary to make that page accessible to people who are connected to the internet.  Such operations are performed, at least in part, automatically.
40. The Court has held, on the subject of Directive 95/46, which is based on Article 100a of the Treaty, that recourse to that legal basis does not presuppose the existence of an actual link with free movement between Member States in every situation referred to by the measure founded on that basis (see Joined Cases C-465/00, C-138/01 and C-139/01  Österreichischer Rundfunk and Others  [2003] ECR I-4989, paragraph 41, and the case-law cited therein).
41. A contrary interpretation could make the limits of the field of application of the directive particularly unsure and uncertain, which would be contrary to its essential objective of approximating the laws, regulations and administrative provisions of the Member States in order to eliminate obstacles to the functioning of the internal market deriving precisely from disparities between national legislations ( Österreichischer Rundfunk and Others , cited above, paragraph 42).
42. Against that background, it would not be appropriate to interpret the expression   " activity which falls outside the scope of Community law"  as having a scope which would require it to be determined in each individual case whether the specific activity at issue directly affected freedom of movement between Member States.
43. The activities mentioned by way of example in the first indent of Article 3(2) of Directive 95/46 (in other words, the activities provided for by Titles V and VI of the Treaty on European Union and processing operations concerning public security, defence, State security and activities in areas of criminal law) are, in any event, activities of the State or of State authorities and unrelated to the fields of activity of individuals.
44. It must therefore be considered that the activities mentioned by way of example in the first indent of Article 3(2) of Directive 95/46 are intended to define the scope of the exception provided for there, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category ( ejusdem generis ).
47. That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.
63. Chapter IV of Directive 95/46, in which Article 25 appears, sets up a special regime, with specific rules, intended to allow the Member States to monitor transfers of personal data to third countries.  That Chapter sets up a complementary regime to the general regime set up by Chapter II of that directive concerning the lawfulness of processing of personal data.
79. According to the seventh recital in the preamble to Directive 95/46, the establishment and functioning of the common market are liable to be seriously affected by differences in national rules applicable to the processing of personal data.  According to the third recital of that directive the harmonisation of those national rules must seek to ensure not only the free flow of such data between Member States but also the safeguarding of the fundamental rights of individuals.  Those objectives may of course be inconsistent with one another.
82. The mechanisms allowing those different rights and interests to be balanced are contained, first, in Directive 95/46 itself, in that it provides for rules which determine in what circumstances and to what extent the processing of personal data is lawful and what safeguards must be provided for.  Second, they result from the adoption, by the Member States, of national provisions implementing that directive and their application by the nationa l authorities.
83. As regards Directive 95/46 itself, its provisions are necessarily relatively general since it has to be applied to a large number of very different situations.  Contrary to Mrs Lindqvist ' s contentions, the directive quite properly includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options.
84. It is true that, in many respects, the Member States have a margin for manoeuvre in implementing Directive 95/46.  However, there is nothing to suggest that the regime it provides for lacks predictability or that its provisions are, as such, contrary to the general principles of Community law and, in particular, to the fundamental rights protected by the Community legal order.
87. Consequently, it is for the authorities and courts of the Member States not only to interpret their national law in a manner consistent with Directive 95/46 but also to make sure they do not rely on an interpretation of it which would be in conflict with the fundamental rights protected by the Community legal order or with the other general principles of Community law, such as inter alia the principle of proportionality.
88. Whilst it is true that the protection of private life requires the application of effective sanctions against people processing personal data in ways inconsistent with Directive 95/46, such sanctions must always respect the principle of proportionality.  That is so  a fortiori  since the scope of Directive 95/46 is very wide and the obligations of those who process personal data are many and significant.
95. Directive 95/46 is intended, as appears from the eighth recital in the preamble thereto, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States.  The tenth recital adds that the approximation of the national laws applicable in this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community.
96. The harmonisation of those national laws is therefore not limited to minimal harmonisation but amounts to harmonisation which is generally complete.  It is upon that view that Directive 95/46 is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate.
97. It is true that Directive 95/46 allows the Member States a margin for manoeuvre in certain areas and authorises them to maintain or introduce particular rules for specific situations as a large number of its provisions demonstrate.  However, such possibilities must be made use of in the manner provided for by Directive 95/46 and in accordance with its objective of maintaining a balance between the free movement of personal data and the protection of private life.