IPKat’s friend Jordgubbar writes to tell us almost Case C-101/01 Bodil Lindqvist, inward which the European Court of Justice (ECJ) delivered its judgment on the interpretation of the Data Protection Directive (Directive 95/46) as well as the Swedish Personuppgiftslag (SFS 1998:2004), which implemented that Directive.
Background to the reference
In 1998, Mrs Lindqvist gear upwardly network pages at abode inward monastic tell to permit parishioners of her church building preparing for their confirmation to obtain information they mightiness need. Those pages contained information almost Mrs Lindqvist as well as xviii colleagues which included approximately household unit of measurement circumstances as well as telephone numbers. She stated that ane colleague had injured her pes as well as was working part-time on medical grounds. She did non yet tell her colleagues of the beingness of those pages or obtain their consent. Nor did she notify the information inspectorate of her activities. The populace prosecutor proceeded against Mrs Lindqvist, charging her alongside breach of the Personuppgiftslag inward that (i) she had processed personal information without prior written notification; (ii) she had processed sensitive personal information without authorization as well as (iii) she had transferred personal information to a tertiary province (by placing it on an network site accessible exterior the EEA) without authorisation.
Article 1 of the Directive sets out the basic protection of the key rights as well as freedoms of natural persons alongside honour to the processing of personal data. Article iii sets out the reach of the Directive: the processing past times whatsoever agency of personal information which forms component division of a filing arrangement or is intended to practise so. It sets out situations inward which the information protection legislation does non apply, including populace safety as well as defense purposes. Further, the Directive does non apply to the processing of personal information past times a soul inward the course of didactics of purely personal or household activities. By virtue of Article 8, for certain types of information are "sensitive personal data", which includes information concerning health.
Summaries of the questions to which the ECJ responded
Question 1: Does the cry of a soul (by cry or alongside a cry as well as telephone number) on an network abode page flora the processing of personal information for the purposes of the Directive?
The term "personal data" covers whatsoever information relating to an identified or identifiable natural person. This includes the cry of a soul inward conjunction alongside his telephone co-ordinates or information almost his working weather condition or hobbies. To practise anything alongside such information constitutes "processing", so the loading of personal information on an network page must last considered processing.
Question 2: The Court did non bespeak to respond this question
Question 3: Does loading such information on to a private homepage autumn inside ane of the exceptions inward Article 3(2)?
The Court considered the exceptions specifically get inward Article 3(2) as well as held that the listing of activities is exhaustive. Charitable or religious activities cannot last considered equivalent to the activities get inward that list. Further, the Court held that the exception inward honour of activities which are alone personal as well as domestic must last interpreted every bit relating but to activities which are carried out inward the course of didactics of private or household unit of measurement life. Mrs Lindqvist submitted that private individuals who brand utilisation of their liberty of appear to create network pages inward the course of didactics of a non-profit or leisure activity are non carrying out an economical activity as well as are thus non discipline to EC law. Citing Österreichischer Rundfunk, the ECJ held that recourse to Article 100(a) of the EC Treaty (the legal reason for the Directive) does non presuppose the beingness of an actual link alongside costless campaign betwixt Member United States of America inward every province of affairs referred to past times the Directive. The Court considered that a opposite interpretation would become against the essential objective of approximating the laws of Member United States of America inward eliminating obstacles to the surgical physical care for of the internal market.
Question 4: Is information that a soul has injured his pes as well as is on one-half fourth dimension on medical grounds "sensitive personal data" for the purposes of Article 8(1).
The ECJ held that such information clearly constitutes personal information concerning wellness inside the pregnant of Article 8(1) as well as is thence sensitive personal information for the purposes of the Directive.
Question 5: Is the placing personal information on a website a transfer of the information inside the pregnant of the Directive as well as does it makes a departure if no private from a tertiary province has accessed the site?
To obtain the information appearing on the internet, an network user would create got to connect to the network as well as to deport out the necessary actions to access those pages. In other words, Mrs Lindqvist's network pages did non comprise the technical agency to mail the information automatically to people who did non intentionally seek access to them. Where personal information is loaded on to a website inward ane province as well as and then appears on the calculator of a soul inward approximately other country, such information is non straight transferred betwixt those 2 people but goes through the calculator infrastructure of the hosting provider where the page is stored.
Since the Directive contained no criteria applicable to the utilisation of the internet, the ECJ did non presume that the legislature intended the appear "transfer of information to a tertiary country" to comprehend the loading of information on to an network page, fifty-fifty if such information is thereby made accessible to persons inward tertiary countries alongside the technical agency to access them.
Question 6: Does the Directive limit liberty of appear or other freedoms as well as rights applicable inside the Community (in particular, those enshrined inward Article 10 of the European Convention of Human Rights)?
The ECJ considered that the provisions of the Directive practise not, inward themselves, pick out almost a restriction which conflicts alongside the full general principles of liberty of appear or other freedoms or rights. It is for national regime as well as courts responsible for applying the national legislation implementing the Directive to ensure a fair residual betwixt those rights as well as interests.
Question 7: Can a Member State furnish to a greater extent than extensive protection for personal information or give it a wider reach that the Directive?
Measures taken past times Member United States of America to ensure the protection of personal information must last consistent alongside the provisions of the Directive. They must every bit good last consistent alongside the objective of the Directive of maintaining a residual betwixt liberty as well as campaign of personal information as well as protection of private life. However, the Court held that a Member State is non prevented from extending the reach of national legislation implementing the provisions of the Directive to areas non included past times its scope, provided that no other provision of Community constabulary precludes it.
wonders whether information protection laws are going to last used every bit a back-door to protecting personal privacy rights. In Douglas as well as Zeta-Jones v Hello! the UK of Britain as well as Northern Republic of Ireland High Court awarded damages for breach of information protection rules, inward add-on to regular damages for breach of confidence, inward an activity for harm to the claimants’ “commercial privacy” interests (see IPKat blog, 12 November).
Famous injured feet inward history here, here and here
Background to the reference
In 1998, Mrs Lindqvist gear upwardly network pages at abode inward monastic tell to permit parishioners of her church building preparing for their confirmation to obtain information they mightiness need. Those pages contained information almost Mrs Lindqvist as well as xviii colleagues which included approximately household unit of measurement circumstances as well as telephone numbers. She stated that ane colleague had injured her pes as well as was working part-time on medical grounds. She did non yet tell her colleagues of the beingness of those pages or obtain their consent. Nor did she notify the information inspectorate of her activities. The populace prosecutor proceeded against Mrs Lindqvist, charging her alongside breach of the Personuppgiftslag inward that (i) she had processed personal information without prior written notification; (ii) she had processed sensitive personal information without authorization as well as (iii) she had transferred personal information to a tertiary province (by placing it on an network site accessible exterior the EEA) without authorisation.
Article 1 of the Directive sets out the basic protection of the key rights as well as freedoms of natural persons alongside honour to the processing of personal data. Article iii sets out the reach of the Directive: the processing past times whatsoever agency of personal information which forms component division of a filing arrangement or is intended to practise so. It sets out situations inward which the information protection legislation does non apply, including populace safety as well as defense purposes. Further, the Directive does non apply to the processing of personal information past times a soul inward the course of didactics of purely personal or household activities. By virtue of Article 8, for certain types of information are "sensitive personal data", which includes information concerning health.
Summaries of the questions to which the ECJ responded
Question 1: Does the cry of a soul (by cry or alongside a cry as well as telephone number) on an network abode page flora the processing of personal information for the purposes of the Directive?
The term "personal data" covers whatsoever information relating to an identified or identifiable natural person. This includes the cry of a soul inward conjunction alongside his telephone co-ordinates or information almost his working weather condition or hobbies. To practise anything alongside such information constitutes "processing", so the loading of personal information on an network page must last considered processing.
Question 2: The Court did non bespeak to respond this question
Question 3: Does loading such information on to a private homepage autumn inside ane of the exceptions inward Article 3(2)?
The Court considered the exceptions specifically get inward Article 3(2) as well as held that the listing of activities is exhaustive. Charitable or religious activities cannot last considered equivalent to the activities get inward that list. Further, the Court held that the exception inward honour of activities which are alone personal as well as domestic must last interpreted every bit relating but to activities which are carried out inward the course of didactics of private or household unit of measurement life. Mrs Lindqvist submitted that private individuals who brand utilisation of their liberty of appear to create network pages inward the course of didactics of a non-profit or leisure activity are non carrying out an economical activity as well as are thus non discipline to EC law. Citing Österreichischer Rundfunk, the ECJ held that recourse to Article 100(a) of the EC Treaty (the legal reason for the Directive) does non presuppose the beingness of an actual link alongside costless campaign betwixt Member United States of America inward every province of affairs referred to past times the Directive. The Court considered that a opposite interpretation would become against the essential objective of approximating the laws of Member United States of America inward eliminating obstacles to the surgical physical care for of the internal market.
Question 4: Is information that a soul has injured his pes as well as is on one-half fourth dimension on medical grounds "sensitive personal data" for the purposes of Article 8(1).
The ECJ held that such information clearly constitutes personal information concerning wellness inside the pregnant of Article 8(1) as well as is thence sensitive personal information for the purposes of the Directive.
Question 5: Is the placing personal information on a website a transfer of the information inside the pregnant of the Directive as well as does it makes a departure if no private from a tertiary province has accessed the site?
To obtain the information appearing on the internet, an network user would create got to connect to the network as well as to deport out the necessary actions to access those pages. In other words, Mrs Lindqvist's network pages did non comprise the technical agency to mail the information automatically to people who did non intentionally seek access to them. Where personal information is loaded on to a website inward ane province as well as and then appears on the calculator of a soul inward approximately other country, such information is non straight transferred betwixt those 2 people but goes through the calculator infrastructure of the hosting provider where the page is stored.
Since the Directive contained no criteria applicable to the utilisation of the internet, the ECJ did non presume that the legislature intended the appear "transfer of information to a tertiary country" to comprehend the loading of information on to an network page, fifty-fifty if such information is thereby made accessible to persons inward tertiary countries alongside the technical agency to access them.
Question 6: Does the Directive limit liberty of appear or other freedoms as well as rights applicable inside the Community (in particular, those enshrined inward Article 10 of the European Convention of Human Rights)?
The ECJ considered that the provisions of the Directive practise not, inward themselves, pick out almost a restriction which conflicts alongside the full general principles of liberty of appear or other freedoms or rights. It is for national regime as well as courts responsible for applying the national legislation implementing the Directive to ensure a fair residual betwixt those rights as well as interests.
Question 7: Can a Member State furnish to a greater extent than extensive protection for personal information or give it a wider reach that the Directive?
Measures taken past times Member United States of America to ensure the protection of personal information must last consistent alongside the provisions of the Directive. They must every bit good last consistent alongside the objective of the Directive of maintaining a residual betwixt liberty as well as campaign of personal information as well as protection of private life. However, the Court held that a Member State is non prevented from extending the reach of national legislation implementing the provisions of the Directive to areas non included past times its scope, provided that no other provision of Community constabulary precludes it.
wonders whether information protection laws are going to last used every bit a back-door to protecting personal privacy rights. In Douglas as well as Zeta-Jones v Hello! the UK of Britain as well as Northern Republic of Ireland High Court awarded damages for breach of information protection rules, inward add-on to regular damages for breach of confidence, inward an activity for harm to the claimants’ “commercial privacy” interests (see IPKat blog, 12 November).
Famous injured feet inward history here, here and here
Komentar
Posting Komentar