ACCESS TO DOCUMENTS AND PROTECTION OF PERSONAL DATA IN LIGHT OF CASE-LAW
1. COURT OF JUSTICE OF THE EUROPEAN UNION
1.3 THE TIETOSUOJAVALTUUTETTU V SATAKUNNAN MARKKINAPÖRSSI OY AND SATAMEDIA OY CASEMARKKINAPÖRSSI OY AND SATAMEDIA OY CASE
To provide a more comprehensive picture of the underlying principles examined in the Markus Schecke and Hartmut Eifert case, it is important to consider the Satakunnan Markkinpörssi case briefly as well.674 The Court of Justice delivered this preliminary ruling in December 2008. While the Schecke and Eifert case concerned disclosure of information giving a clear indication of the incomes of farmers, the Satakunnan Markkinapörssi case relates to publication of the taxation information of a vast number of ordinary citizens.675
670 Joined cases C-92/09 and C-93/09 Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen, ECLI:EU:C:2010:662, para 59.
671 ECtHR 16 February 2000, Amann v Switzerland (2000–II) and ECtHR 4 May 2000, Rotaru v Romania, (RJD 2000–V).
672 Joined cases C-92/09 and C-93/09 Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen, ECLI:EU:C:2010:662, paras 87– 88.
673 Ibid., para 87.
674 Case C-73/07, Satakunnan Markkinapörrsi and Satamedia, ECLI:EU:C:2008:727. The case was also tried before the European Court of Human Rights. The European Court of Human Rights found that there was no violation of Article 10 regarding freedom of expression. ECtHR 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland (ECLI:CE:ECHR:2017:0627JUD000093113).
675 For an analysis of the case, see W. Hins, “Case C-73/07, Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy, Judgment of the Grand Chamber of 16 December 2008” in Common Market Law
1.3.1 THE FACTS OF THE CASE
Satakunnan Markkinapörssi Oy and Satamedia Oy had run a business publishing the taxation information of ordinary citizens for several years, information which is in the public domain in Finland and which Satakunnan Markkinapörssi had collected from various Inland Revenue Offices. The information had then been published in records taking the form of a journal, organized by income and municipality. While many other journals publish taxation information as well, the activities of Satakunnan Markkinapörssi differed in the extent of their data, with the taxation information on nearly 1.2 million taxpayers676 being published. The information contained the first and last names of the person and their income, listed in alphabetical order.
The publications contained hardly anything other than the taxation information with some rare exceptions.677
Following complaints by some individuals claiming that their right to privacy had been breached, the national Data Protection Ombudsman scrutinized Satakunnan Markkinapörssi’s activities, concluding that its processing of personal data did not comply with national data protection legislation. The Data Protection Ombudsman then sought an order to ban this processing of personal data. In the course of these proceedings, the Supreme Administrative Court of Finland referred the case for a preliminary ruling in Luxembourg.678
1.3.2 LEGITIMATE INTEREST
The Supreme Administrative Court posed several questions to the Court of Justice, including questions related to the definition of processing of personal data and the definition of journalistic purposes. The Court of Justice took the view that the data processing described in the previous section could be considered as having been done for journalistic purposes. Whether it was done for this reason was left for the national court to decide. Hence, the processing of this information was to be considered justified if certain criteria were met.679
In its decision, the Court of Justice provided some guidelines for the interpretation of journalistic purposes. It also emphasised that freedom of speech is indeed of the utmost importance in a democracy. It follows that all notions related to freedom of speech, such as journalism, must be interpreted broadly. Once this was clearly
Review 47 (2010), 215–233.
676 This figure should be set in the context of the whole population in Finland, which is 5.3 million.
677 Case C-73/07, Satakunnan Markkinapörrsi and Satamedia, ECLI:EU:C:2008:727, paras 25–26, 28.
678 Ibid., para 31–32.
679 Ibid., paras 34, 50, 61–62.
established, the Court underlined that all exceptions to the right to the protection of personal data must be defined as narrowly as possible to achieve a fair balance between the two fundamental rights.680
At the national level, the Supreme Administrative Court took the view that Satakunnan Markkinapörssi’s activities were not conducted for journalistic purposes. 681
1.3.3 THE NATURE OF THE DATA
As already noted, information related to income does not enjoy special treatment under European data protection legislation. Whereas the information in the public domain gave indications of farmers’ incomes in the Schecke and Eifert case, in the Satakunnan Markkinpörssi case the information disclosed explicitly revealed the income of the data subjects. Nevertheless, the Court of Justice did not see processing such data as being contrary to data protection legislation provided that it was carried out solely for journalistic purposes.682 This approach mirrored the approach the Court took in the Rundfunk case, where the Court decided that disclosing annual income information is not to be considered contrary to EU data protection legislation provided that it is necessary to guarantee the proper management of public funds.683
1.3.4 CONCLUSION OF THE SCHECKE AND EIFERT AND SATAKUNNAN MARKKINAPÖRSSI CASES
The Court of Justice of the European Union was balancing the underlying principles of data protection with other values in these two cases. There was no conflict of rules at the surface level, but rather a tension arising at the underlying levels with an effect on the validity of some legislation. In these judgments, the Court of Justice set some basic guidelines, or Alexy’s circumstances, which would dictate the correct
680 Case C-73/07, Satakunnan Markkinapörrsi and Satamedia, ECLI:EU:C:2008:727, para 56–62.
681 KHO 2009: 82. The Supreme Administrative Court elaborated its decision quite extensively. Among other things, it reasoned its decision as follows. Where the register that has been created for journalistic purposes is published extensively, almost in its entirety, and even if the publication takes place in separate community-based pieces, this type of processing of personal data cannot be considered as being for journalistic purposes.
This reasoning was based on national legislation, which required some minimum standards to be met when personal data was processed this reason. The Supreme Administrative Court held that when the information is released as extensively as in this case, these minimum standards are not actually met, and the processing cannot be considered as carried out for journalistic purposes.
682 Case C-73/07, Satakunnan Markkinapörrsi and Satamedia, ECLI:EU:C:2008:727, para 65.
683 See joined cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others, ECLI:EU:C:2003:294.
balance between these principles in this and similar cases. These circumstances could be called conditions of balancing in line with Alexy’s theory.684
The Court of Justice of the European Union examined transparency in relation to public funding in these cases. Today, when Europe is again on the edge of financial crisis, transparency on expenditure of public funds should be put under even closer scrutiny. Even if the Court of Justice saw the underlying principles of one’s right to privacy and the protection of personal data as weighing more than transparency in the Schecke and Eifert case, this was subject to certain qualifications. First and foremost, the Court of Justice did not consider the underlying principles of data protection more weighty in general. To start with, according to the Court, information relating to legal persons could still be published as before. Under the Data Protection Directive, this information might be personal data if it allows identification of the persons behind the legal undertaking.685 Consequently, the personal data was divided into two categories subject to different criteria for publication. Besides, the Court of Justice did not take the view that information relating to private farmers could not be published at all, seeing the current legislation as disproportionate in respect of its aims and methods. Thus, according to the Court, the disclosure of this information should be done under more detailed provisions, providing clearer limits and boundaries. In the more recent Manni case for example, the CJEU did not see the public access to personal data stored by public authorities as disproportionate from the outset.686
Reading this judgment together with the Court’s judgment in the Satakunnan Markkinapörssi case, it does not seem likely that the Court’s intention would have been to take a definite stand against the disclosure of personal data relating to the expenditure of public funds, but rather to underline the importance of correct balancing between the two principles. In Satakunnan Markkinapörssi, since the Court of Justice did consider that the taxation information on numerous people could be released if it was done for journalistic purposes, disclosing personal data relating to public expenditure can be justified under certain circumstances.687 However, it should not be done lightly, and in a way which compromises privacy and the right to protection of personal data only to the extent strictly necessary in order to achieve the other goals. In other words, balancing must be carried out in accordance with Hesse’s doctrine of practical concordance.
684 R. Alexy, A Theory of Constitutional Rights, (Oxford, 2010) 100–109.
685 According to Article 2(a) of Directive 95/46, ‘personal data’ shall mean any information relating to an identified or identifiable natural person (‘data subject’), an identifiable person being one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity. This did change with the entry into force of the GDPR. The GDPR specifies that it does not apply to undertakings established as legal persons.
686 Case C-398/15, Manni, ECLI:EU:C:2017:197.
687 See also joined cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others, ECLI:EU:C:2003:294.