Last Updated on May 9, 2023 by LawEuro
Legal summary
May 2023
Jehovah’s Witnesses v. Finland – 31172/19
Judgment 9.5.2023 [Section II]
Article 9
Article 9-1
Manifest religion or belief
Decision prohibiting Jehovah’s Witnesses religious community from collecting and processing personal data during door-to-door preaching without data subjects’ consent: no violation
Facts – In 2013 the Data Protection Board, following an application by the Data Protection Ombudsman, prohibited the applicant religious community (Jehovah’s Witnesses) from collecting and processing personal data in connection with door-to-door preaching without meeting the general prerequisites for processing personal and sensitive data specified in the Personal Data Act (“the Act”), that is, without the unambiguous consent of the data subject. It held that the applicant community and its members who collected data were regarded as controllers within the meaning of the Act and ordered the applicant community to ensure, within six months, that no personal data were collected for its purposes without the prerequisites for processing such data being met.
The Administrative Court allowed the applicant community’s appeal in part, holding that the collection and processing of data during preaching activities required the express and explicit consent of the persons concerned but that the applicant community could not be regarded as a “controller” under the Act. Subsequently, on appeal by the Ombudsman, the Supreme Administrative Court sought a preliminary ruling from the Court of Justice of the European Union (“CJEU”) concerning the issue of whether the applicant community should be considered a “controller” of the personal data collected and processed by its members in the course of their door-to-door preaching within the meaning of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Data Protection Directive”). In its judgment of 10 July 2018 (Jehovan todistajat, C-25/17) the CJEU held that it should. The Supreme Administrative Court then quashed the Administrative Court’s decision in so far as it had annulled the Board’s decision, thereby bringing the latter into force. Both domestic courts rejected the applicant community’s request for an oral hearing.
Law –
Article 9:
The core question in the present case was whether the correct balance had been struck between the right of the applicant community’s religion to manifest its faith under Article 9 and the right to privacy of data subjects as embodied in domestic data protection legislation and as protected under Article 8. The Court thus outlined the general principles deriving from its case-law on Article 9, on the one hand, and the right to privacy under Article 8 in the particular context of data protection, on the other.
(i) Existence of an interference, prescribed by law and legitimate aim –
The application of the consent requirement to the collection and processing of personal and sensitive data in the course of door-to-door preaching, a religious activity intended to manifest or spread the faith of the Jehovah’s Witnesses, had constituted an interference with the applicant community’s rights under Article 9.
The interference had been prescribed by law, namely the Personal Data Act, as in force at the material time, which had transposed the Data Protection Directive.
The Supreme Administrative Court had followed the CJEU’s interpretative guidance on the Directive relevant for the main legal issues contested by the applicant community, providing a similar interpretation of the relevant provisions of the Act, and had applied them, taking account of the relevant established facts. The manner in which it had interpreted the Act had not been arbitrary or unreasonable.
The interference had pursued the legitimate aim of protecting “the rights and freedoms of others”, data subjects in the present case.
(ii) Necessary in a democratic society –
The Act aimed to ensure protection of the right to respect of private life, including the right to privacy of data subjects. The consent requirement under the Act for the collection and processing of personal and sensitive data had its origin in the Data Protection Directive. In the absence of any evidence and counter-arguments by the applicant community, the Supreme Administrative Court had established that individual Jehovah’s Witnesses, at least in general, did not ask data subjects to consent expressly to the processing of personal data, nor did the applicant community instruct them to do so. It held that the Board’s order had not been made in an attempt to hinder the religious practices of individual Jehovah’s Witnesses but rather for reasons that had to do with the processing of personal data. The right to privacy also belonged to people whose personal data was being processed, and they had the right to expect that provisions regarding the processing of personal data be complied with. Although part of the personal data in question could be available from public sources the Supreme Administrative Court had considered that possibility immaterial for its conclusions. Accordingly, it had examined the matter by carrying out a balancing exercise between the privacy rights of data subjects and the applicant community’s right to freedom of religion.
The Court concurred with the Supreme Administrative Court that data subjects had a reasonable expectation of privacy with regard to personal and sensitive data being collected and processed in the course of door‑to‑door preaching. The fact that some personal data might be already in the public domain neither reduced this expectation nor did it mean that such data needed less protection. That approach found support in the relevant jurisprudence of the CJEU. The consent requirement was to be considered an appropriate and necessary safeguard with a view to preventing any communication or disclosure of personal and sensitive data inconsistent with the guarantees in Article 8 in the context of door‑to‑door preaching by individual Jehovah’s Witnesses. The Court could not discern how simply asking for, and receiving, the data subject’s consent would hinder the essence of the applicant community’s freedom of religion. The applicant community had failed to present any supporting evidence of the alleged “chilling effect” of the Board’s order, notwithstanding the lapse of time since the Supreme Administrative Court’s decision. Lastly, the Act applied without distinction to all religious communities and religious activities and no fine had been imposed on the applicant community.
Accordingly, there were no strong reasons for the Court to substitute its view for that of the domestic courts and set aside the balancing done by them. The reasons relied upon had been both relevant and sufficient to show that the interference had been “necessary in a democratic society” and the authorities had acted within their margin of appreciation in striking a fair balance between the competing interests at stake.
Conclusion: no violation (unanimously).
The Court also found, unanimously, that there had been no violation of Article 6 § 1 as there had been exceptional circumstances in the case which had justified dispensing with an oral hearing.
(See also Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland [GC], 931/13, 27 June 2017, Legal Summary)
Leave a Reply