ECLI:FI:KHO:2018:171

The case involved deciding whether the Finnish Data Protection Board had been within its rights to prohibit the Jehovah’s Witnesses religious community (“the community”) from collecting or otherwise processing personal data in the context of door-to-door preaching without satisfying one of the general prerequisites for processing referred to in Section 8 of the Finnish Personal Data Act and the criteria referred to in Section 12 of the Act in respect of sensitive data. The Administrative Court granted the community’s appeal and overturned the Finnish Data Protection Board’s decision with the exception of the forms the use of which the community had admitted and which it had promised to abandon. The Supreme Administrative Court granted the Data Protection Ombudsman’s appeal and reversed the Administrative Court’s ruling, reinstating the Finnish Data Protection Board’s decision.

Questions before the Court

Among key questions in the case were whether the processing of personal data in connection with door-to-door preaching was exempt from the application of the Data Protection Directive and, if it was not, whether the personal data contained in the notes made in the course of preaching constituted a personal data file or files, whether the community could be regarded as a controller jointly with the individual Jehovah’s Witnesses who had made the notes that contained the personal data and whether the processing of the personal data was, contrary to the Finnish Data Protection Board’s view, in compliance with the Personal Data Act. The Court also had to consider various views put forward by the community that related to the right to privacy, freedom of religion, freedom of speech and the prohibition of discrimination.

Evidence presented in the case on the making of notes

The contents of the notes made by individual Jehovah’s Witnesses in connection with door-to-door preaching, where notes were made, varied according to their personal practices and the situations encountered in the course of preaching. The way in which notes were recorded also varied. Some recorded their notes on paper manually and others entered the information electronically into a mobile device. Notes were made, for example, about house or apartment numbers, residents’ surnames or the fact that no more visits were welcome to a certain apartment or a certain person as well as, in connection with subsequent visits, about the first names and/or surnames of the persons visited or their gender, their address (potentially without recording their name or gender) and other contact details, the times agreed for subsequent visits and topics of conversation. The community had also given its members guidelines on the taking of notes relating to subsequent visits in its publication.

Legal evaluation

A considerable portion of the entries made in the notes indisputably constituted personal data within the meaning of Section 3(1) of the Personal Data Act. Some of the notes also contained sensitive personal data within the meaning of Section 11 of the Personal Data Act.

Considering the judgment delivered by the Court of Justice of the European Union in response to the Supreme Administrative Court’s request for a preliminary ruling, the Supreme Administrative Court found that the collection of personal data by individual Jehovah’s Witnesses, i.e. members of the community, in the course of door-to-door preaching and the subsequent processing of those data did not constitute the processing of personal data carried out by a natural person in the course of a purely personal or household activity within the meaning of Section 2(3) of the Personal Data Act. The fact that certain individual Jehovah’s Witnesses may have formed friendships or acquaintances with some of the individuals whose personal data were included in the notes could not be seen to change this conclusion when all the circumstances were taken into account. Grounds for not applying the Personal Data Act therefore could not be derived from Section 2(3) of the Act in this case. The fact that some of the personal data collected in the course of door-to-door preaching were publicly available was also not relevant from the perspective of the applicability of the Personal Data Act.

The Court of Justice of the European Union found in its judgment that Article 2(c) of the Data Protection Directive must be interpreted as meaning that the concept of a ‘filing system’, referred to by that provision, covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use. In order for such a set of data to fall within that concept, it is not necessary that they include data sheets, specific lists or other search methods.

Making notes that contained personal data was an element of preparing for subsequent visits relating to door-to-door preaching. Although the ways in which individual Jehovah’s Witnesses recorded and structured the personal data and the techniques they used may have differed from each other, it would not even have made sense in certain respects to make notes, had the data not also been structured according to criteria which enabled data concerning specific individuals and their addresses to be easily found on that basis.

In view of the above and considering the judgment of the Court of Justice of the European Union, the Supreme Administrative Court found that, at least in some cases, the notes containing personal data collected on paper in the course of door-to-door preaching constituted a personal data file, or a part thereof, within the meaning of Section 3(3) of the Personal Data Act, which therefore also meant that the processing of such personal data was governed by the Personal Data Act. The personal data collected in the course of door-to-door preaching that were entered electronically into a mobile device also constituted a personal data file or a part thereof.

The Court of Justice of the European Union found in its judgment that Article 2(d) of the Data Protection Directive, read in the light of Article 10(1) of the Charter of Fundamental Rights, must be interpreted as meaning that it supports the finding that a religious community is a controller, jointly with its members who engage in preaching, for the processing of personal data carried out by the latter in the context of door-to-door preaching organised, coordinated and encouraged by that community, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing.

The making of notes containing personal data was inherently linked to door-to-door preaching the purpose of which was to spread the faith. Door-to-door preaching was organised and coordinated by creating maps/records of areas. The community’s congregations kept records about preachers and the number of the community’s publications distributed by them as well as the amount of time they had spent on preaching. The congregations’ area maps/records contained notes about individuals who had requested not to receive visits from Jehovah’s Witnesses. In addition, the community had given its members guidelines on the taking of notes in its publication.

Although door-to-door preaching was also an element of individual Jehovah’s Witnesses’ personal religious practice, preaching was effectively organised, coordinated and encouraged by the community. The community had to be deemed to have effectively participated in the determination of the purpose and means of the personal data processing inherently linked to the aforementioned practice. In view of the above and considering the judgment of the Court of Justice of the European Union, the Supreme Administrative Court found that the community had to be regarded as a controller, within the meaning of Section 3(4) of the Personal Data Act, of the personal data file(s) created in the course of door-to-door preaching jointly with the individual Jehovah’s Witnesses who had made the notes that contained the personal data. Considering the decentralised nature of the collection of the data and the de facto status of the community as the organiser of its members’ activities and as an enabler of the transmission of the data, the Finnish Data Protection Board’s decision to only challenge the community was, in itself, justified.

The processing of personal data in connection with door-to-door preaching was not based on the data subjects’ being customers or members of the community or, as a rule, on any of the other circumstances referred to in Sections 8(1)(2)–8(1)(9) of the Personal Data Act, and the processing therefore had to, in practice, be based on the data subjects’ unambiguous consent within the meaning of Section 8(1)(1) of the Act. The individual Jehovah’s Witnesses engaged in door-to-door preaching did not, or at least not usually, ask for the data subjects’ unambiguous consent for the processing of their personal data, and there is nothing in the documents to suggest that the community had instructed them to do so either. The processing of personal data in connection with door-to-door preaching therefore did not, or at least not in most cases, satisfy the prerequisites laid down in the Personal Data Act.

Religious communities or religious activities were not exempt from the regulations concerning the processing of personal data under the Personal Data Act. Neither could requiring compliance with the Personal Data Act be deemed to restrict the community’s or individual Jehovah’s Witnesses’ right to privacy and freedom of speech under the Constitution of Finland, the European Convention on Human Rights and the Charter on Fundamental Rights of the European Union.

The Finnish Data Protection Board’s decision was not based on the fact that it was Jehovah’s Witnesses in particular who were processing the personal data or on any attempt to complicate the religious practice of individual Jehovah’s Witnesses or the community’s activities but on reasons relating to the processing of personal data that had come to light in the case. The decision did not place the community or individual Jehovah’s Witnesses in an unequal position compared to other religious communities or their members. The decision also did not violate the provisions of the Constitution of Finland, the European Convention on Human Rights or the Charter on Fundamental Rights of the European Union concerning the prohibition of discrimination and the principle of equality, as the limitations on the scope of application of the Personal Data Act laid down in Section 2(5) of the Act did not apply to the processing of personal data for religious purposes.

Constitution of Finland, Sections 6, 10, 11 and 12

European Convention on Human Rights, Articles 8, 9, 10 and 14 and Protocol No 12, Article 1

Charter on Fundamental Rights of the European Union, Articles 7, 8, 10, 11 and 21

Personal Data Act, Sections 1, 2, 3, 8(1), 11, 12(1), 44(1) and 44(2)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Directive), Articles 2(c) and 2(d) and Articles 3(1) and 3(2)

Ruling of the Supreme Administrative Court of Finland in Case KHO 2016:208

Judgment of 10 July 2018 of the Court of Justice of the European Union in Case C-25/17 Jehovah’s Witnesses

Judgment of 5 June 2018 of the Court of Justice of the European Union in Case C-210/16 Wirtschaftsakademie Schleswig-Holstein