(Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Scope of the directive — Article 3 — Data collected and processed by the members of a religious community in the course of their door-to-door preaching — Article 2(c) — Definition of a ‘personal data filing system’ — Article 2(d) — Definition of a ‘controller’ of the processing of personal data — Article 10(1) of the Charter of Fundamental Rights of the European Union)
SOURCE: Court of Justice of the European Union, Annual report 2018
In the judgment in Jehovan todistajat of 10 July 2018, the Grand Chamber of the Court adjudicated on the responsibility of a religious community for the processing of personal data carried out in the context of door-to-door preaching organised, coordinated and encouraged by that community. In the main proceedings, the Finnish data protection authority had adopted a decision prohibiting the Jehovah’s Witnesses community from collecting or processing personal data in the course of door-to-door preaching carried out by its members unless the requirements for processing such data laid down in Finnish law were satisfied. The members of that community take notes in the course of their door-to-door preaching about visits to persons who are unknown to themselves or that Community. Those data are collected as a memory aid and in order to be retrieved for any subsequent visit without the knowledge or consent of the persons concerned. The Jehovah’s Witnesses community had established guidelines on the taking of such notes which appear in at least one of its magazines which is dedicated to preaching.
The Court considered, first of all, that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data does not fall within the exceptions to the scope of Directive 95/46 since it does not constitute either the processing of personal data for the purpose of activities referred to in Article 3(2), first indent, of that directive or the processing of personal data carried out by a natural person in the course of a purely personal or household activity, within the meaning of Article 3(2), second indent, thereof.
Secondly, the Court — after recalling that Directive 95/46 applies to the manual processing of personal data only where the data processed form part of a filing system or are intended to form part of a filing system — found that the concept of ‘filing system’, referred to in Article 2(c) of that directive, covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use. In order for such a set of data to fall within that concept, it is not necessary that they include data sheets, specific lists or other search methods.
Lastly, the Court considered that the obligation for every person to comply with the rules of EU law on the protection of personal data cannot be regarded as an interference in the organisational autonomy of religious communities. In that connection, it concluded that Article 2(d) of Directive 95/46, read in the light of Article 10(1) of the Charter, must be interpreted as meaning that it supports the finding that a religious community is a controller, jointly with its members who engage in preaching, for the processing of personal data carried out by the latter in the context of door-to-door preaching organised, coordinated and encouraged by that community, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing.