SECOND SECTION
CASE OF JEHOVAH’S WITNESSES v. FINLAND
(Application no. 31172/19)
JUDGMENT
Art 9 • Manifest religion or belief • Decision prohibiting Jehovah’s Witnesses religious community from collecting and processing personal data during door-to-door preaching without data subjects’ consent • Interpretation of relevant data protection provisions, following guidance by the Court of Justice of the European Union, not arbitrary or unreasonable • Statutory consent requirement an appropriate and necessary safeguard with no evidence of any “chilling effect” • Relevant and sufficient reasons • Fair balance struck between competing Art 9 and Art 8 interests • Interference “necessary in a democratic society” and within State’s margin of appreciation
Art 6 (administrative) • Exceptional circumstances which justified dispensing with an oral hearing
STRASBOURG
9 May 2023
This judgment will become final in the circumstances set out in Article 44 § 2 of the Convention. It may be subject to editorial revision.
In the case of Jehovah’s Witnesses v. Finland,
The European Court of Human Rights (Second Section), sitting on 4 April 2023 as a Chamber composed of:
Arnfinn Bårdsen, President,
Jovan Ilievski,
Egidijus Kūris,
Pauliine Koskelo,
Lorraine Schembri Orland,
Diana Sârcu,
Davor Derenčinović, judges,
and Hasan Bakırcı, Section Registrar,
Having regard to:
the application (no. 31172/19) against the Republic of Finland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Finnish religious community, Jehovan todistajat (“the applicant community”), on 10 June 2019;
the decision to give notice to the Finnish Government (“the Government”) of the complaints under Articles 6, 8, 9, 10 and Article 14, read in conjunction with Articles 8, 9, 10 and Article 1 of Protocol No. 12 to the Convention;
the parties’ observations;
Having deliberated in private on 4 April 2023,
Delivers the following judgment, which was adopted on that date:
INTRODUCTION
1. The application concerns the incompatibility, as established by the domestic authorities, of the religious activities of the applicant religious community (Jehovah’s Witnesses) with data protection regulations regarding personal data collected in the context of door-to-door preaching without the explicit consent of data subjects. The applicant community relies on Articles 6, 8, 9, 10 and Article 14, read in conjunction with Articles 8, 9, 10 of the Convention and Article 1 of Protocol No. 12 to the Convention.
THE FACTS
2. The applicant community, Jehovan todistajat (Jehovah’s Witnesses), is a Finnish religious community based in Vantaa. It was represented before the Court by Mr P. Muzny and Mr S.H. Brady, lawyers practising in Strasbourg.
3. The Finnish Government (“the Government”) were represented by their Agent, Ms K. Oinonen, from the Ministry for Foreign Affairs.
4. The facts of the case may be summarised as follows.
5. In October 2000 the Data Protection Ombudsman (tietosuojavaltuutettu, dataombudsmannen – “the Ombudsman”) issued an opinion (89Û/45/97) about the applicant community’s data collection practices indicating, inter alia, that personal data could be collected in the course of door-to-door preaching by individual Jehovah’s Witnesses only with the consent of data subjects. With reference to that opinion, in 2011 a complaint was lodged with the Ombudsman regarding the way in which Jehovah’s Witnesses took notes during their door-to-door preaching and whether such notes amounted to personal data forming a “personal data file” within the meaning of the Personal Data Act (henkilötietolaki, personuppgiftslagen, Act no. 523/1999, see paragraph 30-35 below). It was alleged, inter alia, that deaf people and foreigners were visited by Jehovah’s Witnesses who knew sign language and the foreign language respectively. Reference was also made to instructions published in a leaflet entitled “Our Kingdom Ministry” and an official form (S-43) used for that purpose. In response to the Ombudsman’s requests for clarification, the applicant community confirmed that local congregations of Jehovah’s Witnesses maintained a “manual filing system” containing the names and addresses of people who wished not to be visited by Jehovah’s Witnesses, and argued that those data subjects voluntarily and consciously “approve[d] the collection of their data by virtue of the fact that they ask[ed] not to be visited by any Jehovah’s Witnesses” and that “[t]he congregations could not comply with such a request without collecting the person’s name and address.” It was further submitted that individual Jehovah’s Witnesses were not under any obligation by the applicant community to keep records regarding the people they met. Such personal notes were not seen, obtained or retained by the applicant community or congregations and were, in principle, ultimately discarded by the individual member who made them. The applicant community or congregations maintained no lists, card indexes or directories of interested people, including deaf people and foreigners, nor were any such data retrievable. As regards form S-43, it was explained that the congregation acted as “an informal mailing system” in that “a congregation elder forward[ed] an individual’s personal notes on form S-43 to another individual Jehovah’s Witness. The congregation elder and the [applicant community] [did] not retain copies of the information or use the personal data in any way ... The form [was] either sent directly by the contacting Witness or through a congregation elder.”
Proceedings before the Data Protection Board6. On 3 April 2013 the Ombudsman submitted an application to the Data Protection Board (tietosuojalautakunta, datasekretessnämnden – “the Board”), requesting it to prohibit the applicant community, within an appropriate time-limit and on pain of a fine, from collecting and otherwise processing personal data in the course of its door-to-door preaching, as well as data on foreigners and deaf people, without the consent of those in question. Moreover, the Ombudsman requested that the Board order the applicant community on pain of a fine to give instructions to its congregations and individual Jehovah’s Witnesses regarding the need to obtain consent to collect and process personal data in the course of door-to-door preaching. The Ombudsman claimed that the applicant community acted as a “controller” within the meaning of the Personal Data Act (see paragraph 32 below) regarding the notes and contact information about data subjects collected by individual Jehovah’s Witnesses in connection with their door-to-door preaching. As this was not a case where personal data were being processed for purely personal purposes or for comparable ordinary and private purposes, the Personal Data Act applied to the processing of the personal data in question. Furthermore, given the absence of any membership or other pertinent relationship within the meaning of sections 8 and 12 of the Personal Data Act between data subjects and the applicant community (paragraphs 33 and 35 below), the collection and processing of the personal data in question always required the consent of the people in question.
7. In its submissions in reply of 12 June 2013, the applicant community argued that it could not be regarded as a “controller” as it had no access, control or other authority over private notes made by individual Jehovah’s Witnesses. Form S-43 (known as the “Please Follow Up” form) issued by the applicant community and forwarded by someone holding office in a congregation (a congregation secretary) with a view to securing an individual Jehovah’s Witness with appropriate skills (for foreigners and people using sign language) was a “referral note to facilitate contact” which was subsequently destroyed; it was not an automatic processing of data, and the data did not constitute and were not intended to constitute a personal data file. The Personal Data Act did not apply to door-to-door preaching by individual Witnesses because the notes taken during such visits, which were to be seen in the context of freedom of religion, were made solely for personal and private purposes. They helped individual Jehovah’s Witnesses to remember, inter alia, the topic discussed and questions he or she had promised to answer during the next visit, or simply to take into consideration the feelings and wishes of the person visited so that the same Witness would not visit him or her too often.
8. On 17 September 2013 the Board rendered a decision which, as stated therein, pertained to the lawfulness of processing personal data in connection with door-to-door preaching and not door-to-door preaching per se. The Board prohibited the applicant community from collecting and processing personal data in connection with door-to-door preaching without meeting the general prerequisites for processing personal and sensitive data specified in sections 8 and 12 of the Personal Data Act respectively, that is, without the unambiguous consent of the data subject. The Board noted that the definition of personal data was broad. According to the Board, when names, addresses and other personal information were noted down in connection with door‑‑to‑door preaching by Jehovah’s Witnesses that served, as argued by the applicant community, as a memory aid when revisiting people who had shown interest, personal data that could be retrieved were being collected. When, for example, a data subject’s religious affiliation or state of health was noted down, sensitive data were being collected.
9. The Board further noted that the definition of a personal data file was also broad. Such a file was created when data about a particular person were sorted so that they could be retrieved easily. Information about individuals using a foreign language or sign language (personal name, gender, address, telephone number and language of the person who had shown interest) collected by means of form S-43 facilitated the retrieval and transfer of data concerning a certain person and resulted in the creation of personal data files.
10. The Board took note of the leaflet entitled “Our Kingdom Ministry” (adduced in evidence by the Ombudsman, see paragraph 5 above) published by the applicant community proposing what might be recorded in personal notes, namely the name and address of the person concerned, as well as information relating to his or her religious affiliation and family. Although individual Jehovah’s Witnesses could decide whether or not they would take notes and what their content would be, the information in question “was collected for the activity of the community and in accordance with its guidelines”. The Board held that taking notes in connection with that activity could not be viewed as processing personal data for personal purposes or for comparable ordinary and private purposes, but to fulfil the purposes of the applicant community as a religious association. Furthermore, on the basis of information provided by the Ombudsman, the Board established that door‑to‑door preaching was carried out by “territory” and that, consequently, notes were likewise sorted by territory. Therefore, the applicant community and its members who collected data were regarded as controllers within the meaning of the Personal Data Act, as in the definition of a controller it was not essential who stored the data.
11. The Board ordered the applicant community to ensure, within six months, that no personal data were collected for its purposes without the prerequisites for processing such data being met. The Board did not deem it necessary to impose a fine in the matter.
Proceedings before the Administrative Court12. On 17 October 2013 the applicant community and two individual Jehovah’s Witnesses appealed against the Board’s decision to the Helsinki Administrative Court (hallinto-oikeus, förvaltningsdomstolen – “the Administrative Court”). Reiterating the applicant community’s arguments (see paragraph 7 above), the appellants requested the court to amend the Board’s decision so that it would not regard the applicant community or its individual members as “controllers” and would consider the private notes taken by individual Jehovah’s Witnesses in connection with their door‑to‑door preaching as made for “personal purposes or for comparable ordinary and private purposes only”. According to the applicant community, the private notes were not made on its behalf and “serve[d] solely as a memory aid when revisiting those who show[ed] interest.” It was argued that “the [applicant community] encourage[d] Witnesses to have a share in ‘telling the good news’ ... and [that] it ... ma[d]e practical recommendations as to how the individual [might] make use of his religious freedom in an effective way to the benefit of interested listeners.” The appellants contested the Board’s findings that the information in question was collected by Jehovah’s Witnesses for purposes related to “the activity of the community and in accordance with its guidelines” as it presupposed an appropriate legal basis, namely a contractual or membership relationship between individual Witnesses and the applicant community. The former (contractual relationship) did not exist and the latter (membership) was “determined by the religious confession of Jehovah’s Witnesses and [the applicant community’s] inner membership structure, which [was] protected under Article 11 of the [Convention].” Furthermore, the leaflet referred to in the Board’s decision was the same in all countries and was of a general nature “giving some suggestions only”. The appellants also requested that an oral hearing be held in the course of the proceedings “in order to enable [the applicant community] to present evidence on the private nature of the notes as well as to provide evidence for [it] not falling within the scope of the definition of ‘controller’ within the meaning of section 3(4) of [the] Personal Data Act (523/1999) and Article 2(d) of Directive 95/46/EC”. In further submissions, the appellants argued that an oral hearing was decisive in order to supplement the reasoning presented in the written documents. The applicant community further informed the court that it had decided to stop using form S-43. Moreover, the appellants asked that the court request the Court of Justice of the European Union (CJEU) to give a preliminary ruling on Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter “the Data Protection Directive”). Lastly, the appellants argued that the result of upholding the Board’s decision “would be that individual Jehovah’s Witnesses would have no choice other than to witness in a disorganised manner, by contacting and visiting people randomly and, unintentionally, repeatedly”, the effect of which “would impinge upon the personal autonomy and freedom of individuals who [did] not wish to be excessively disturbed (Article 8 of the [Convention]). [That] would also run counter to the aim of Jehovah’s Witnesses, who want[ed] to share the message of the Gospel in a peaceful, respectful and orderly manner (Article 9 of the [Convention])”.
13. On 18 December 2014 a three-judge panel of the Helsinki Administrative Court dismissed the appeal without examining the merits with regard to the two individual Jehovah’s Witnesses on the grounds that the Board’s decision had not been addressed to them and could not be considered to directly affect their rights, obligations or interests. It rejected the part of the appeal pertaining to the prohibition of the use of form S-43 (see paragraph 9 above) for people using a foreign language or sign language, which the applicant community had meanwhile withdrawn. It also rejected the request for a preliminary ruling from the CJEU. As regards the request for an oral hearing, the court referred to the relevant statutory provisions (see paragraph 38 below) and noted that an oral hearing would not be held if the claim was dismissed without considering its merits, or if it was rejected or if an oral hearing was manifestly unnecessary in view of the nature of the matter or for other reasons. In the present case, it held that an oral hearing was manifestly unnecessary in view of the outcome of the case.
14. As regards the merits of the case, the court firstly noted that the Personal Data Act transposed the Data Protection Directive into Finnish law. It further held it established that door-to-door preaching was carried out as part of the activities of the applicant community and was a manifestation of belief of its individual members.
Referring to the instructions contained in the leaflet issued by the applicant community, the court held that in the course of its preaching activities, individual members could engage in collecting data regarding people who were outside of the applicant community and new for its members. The collection of such data could not be considered the processing of personal data for purely personal purposes or for comparable ordinary and private purposes within the meaning of section 2(3) of the Personal Data Act (see paragraph 31 below). Accordingly, the express and explicit consent of the person concerned was required for the collection and processing of such data.
Notwithstanding the above, the court held that the applicant community could not be regarded as a “controller” within the meaning of section 3(4) of the Personal Data Act (see paragraph 32 below) solely on the grounds that it had given instructions in its leaflet to its members regarding the unlawful processing of personal data. According to the court, it had not been shown that the data possibly collected by individual members would constitute a personal file for the use of the applicant community over which it exercised any authority. Accordingly, it allowed the appeal and annulled the Board’s decision in the relevant part.
Proceedings before the Supreme Administrative CourtThe parties’ submissions15. On 16 January 2015 the Ombudsman appealed against the Administrative Court’s decision to the Supreme Administrative Court (korkein hallinto-oikeus, högsta förvaltningsdomstolen), requesting it to quash the Administrative Court’s decision in so far as it had allowed the applicant community’s appeal. The Ombudsman argued that the applicant community had to be regarded as a “controller” of the notes taken by its individual members in connection with door-to-door preaching. In the Ombudsman’s opinion, the applicant community had “significantly determined the purpose and means for the processing of personal data”. Since “the making of personal notes in the course of door-to-door preaching [was] an activity carefully instructed and organised by the [applicant community] and carried out by individual Jehovah’s Witnesses”, it had to be regarded as a “controller” within the meaning of the Personal Data Act. That was the case even if the personal notes made in connection with visits or part thereof were in the possession of individual Jehovah’s Witnesses. This was because the applicant community had actual authority to collect and process the data. It was further reiterated that the congregations kept territory cards on the basis of which preaching territories were allocated to individual Jehovah’s Witnesses.
16. On 20 April 2015 the applicant community submitted its submissions in reply to the Supreme Administrative Court. It was argued that any notes (no example of such a note was produced in evidence) ostensibly made by individual Jehovah’s Witnesses in the exercise of their individual religious conscience served as a memory aid and fell outside the scope of the Personal Data Act. The applicant community confirmed that some Jehovah’s Witnesses might choose to make a brief informal personal note following a conversation, which was of a private nature. Such notes were not disclosed to anyone else. There was no form, no file and no automatic or systematic structure for maintaining or retrieving that information, which was ultimately destroyed. Furthermore, the applicant did not order or direct individual Jehovah’s Witnesses to participate in evangelism. It was a legal entity, the sole purpose of which was to facilitate the religious worship of Jehovah’s Witnesses, such as by renting or building places of worship or importing and producing religious literature. It further did not check, verify, direct, control, restrain or regulate the private notes that individual Jehovah’s Witnesses might choose to make in the course of their door-to-door preaching.
The applicant further argued that there was no “reasonable expectation of privacy” that would attract the applicability of Article 8 of the Convention since the information allegedly in the notes was either publicly available (telephone directories or publicly accessible lists in all residential apartment buildings of residents’ names and apartment numbers) or voluntarily disclosed by data subjects (during conversations). In contrast, requiring individual Jehovah’s Witnesses to obtain explicit consent under the Personal Data Act before making any personal “notes” would have a “chilling effect” on freedom of religion and expression contrary to Articles 9 and 10 of the Convention.
Lastly, the applicant community complained under Article 14, read in conjunction with Articles 9 and 10 of the Convention, that “the application of the Personal Data Act, and section 8(1) in particular, to the religious preaching of individual Jehovah’s Witnesses” would violate the prohibition on discrimination since a similar requirement was not imposed on other private discussions between citizens (conversations with friends, family and even brief acquaintances). The Personal Data Act did not apply to the exchange of their contact information. Furthermore, there was no “objective and reasonable” justification for exempting “journalism or artistic or literary expression”, as provided for in section 2(5) of the Personal Data Act (see paragraph 31 above) but not also “religious expression and, in particular, the brief private notes made by individual Jehovah’s Witnesses in furtherance of their religious preaching”.
Request for a preliminary ruling by the Court of Justice of the European Union17. On 22 December 2016 the Supreme Administrative Court decided to adjourn the proceedings and request a preliminary ruling from the CJEU concerning the issue of whether the applicant community should be considered a “controller” of the personal data collected and processed by its members in the course of their door-to-door preaching within the meaning of the Data Protection Directive (see paragraph 40 below). Reference was made, inter alia, to the fact that the applicant community and its congregations maintained territory maps for the purpose of dividing territories between members participating in door-to-door preaching, as well as a so-called “prohibition register”, which was a record of people who had requested not to be visited by members taking part in that activity.
18. In written submissions to the CJEU, the applicant community argued that the principal facts in the case were in dispute and that the Ombudsman’s allegations were not supported by any concrete evidence. Furthermore, no individual Jehovah’s Witnesses had been interviewed or allowed to take part in the proceedings. It further reiterated its earlier arguments about the personal nature of the notes and the reasons why it could not be regarded as a “controller”. A territory map aimed to enable “orderly contact with residents in the community”. The congregations divided their geographic area into “territory maps”, but congregation members were free to choose any available territory map convenient for their individual door-to door preaching. “The territory map [was] usually a simple photocopy of a few city blocks from a public municipal map” and “contained no personal data”.
19. Following an oral hearing held on 28 November 2017, the CJEU delivered its judgment on 10 July 2018 (judgment of the Grand Chamber of 10 July 2018 in Jehovan todistajat, C-25/17, EU:C:2018:551). As regards the applicant community’s arguments concerning the facts of the case and its request to reopen the oral phase of those proceedings, the latter held as follows:
“27. ... Furthermore, that party and the other interested parties ... submitted, both during the written phase and the oral phase of the proceedings, their observations concerning the interpretation of Article 2(c) and (d), and Article 3 of Directive 95/46, read in the light of Article 10 of the Charter [of Fundamental Rights of the European Union] ...
28. As regards the facts in the main proceedings, it must be recalled that in proceedings under Article 267 TFEU, only the court making the reference may define the factual context in which the questions which it asks arise or, at very least, explain the factual assumptions on which the questions are based. It follows that a party to the main proceedings cannot allege that certain factual premisses on which the arguments advanced by the other interested parties referred to in Article 23 of the Statute of the Court of Justice of the European Union are based, or the analysis of the Advocate General, are incorrect in order to justify the reopening of the oral procedure, on the basis of Article 83 of the Rules of Procedure (see, to that effect, judgment of 26 June 2008, Burda, C-284/06, EU:C:2008:365, paragraphs 44, 45 and 47) ...
29. ... the Court ... considers that it has all the evidence necessary to enable it to reply to the questions referred and that the present case does not thereby fall to be decided on the basis of an argument which has not been debated between the parties. The request to reopen the oral procedure must therefore be rejected.
...
32. In the present case, the order for reference contains sufficient factual and legal information to understand both the questions referred for a preliminary ruling and their scope. Further, and most importantly, nothing in the file leads to the conclusion that the interpretation requested of EU law is unrelated to the actual facts of the main action or its object, or that the problem is hypothetical, in particular on account of the fact that the members of the Jehovah’s Witnesses Community whose collection of personal data is the basis for the questions referred are not parties to the main proceedings.”
20. As regards the nature of personal data processing in the context of door-to-door preaching, the CJEU stated that:
“35. In order to answer that question, it should be observed from the outset, as is clear from Article 1(1) and recital 10 of Directive 95/46, that that directive seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data ...
...
37. However, Article 3(2) lays down two exceptions to the scope of application of that directive which must be strictly interpreted ...
...
39. In the present case, the collection of personal data by members of the Jehovah’s Witnesses Community in the course of door-to-door preaching is a religious procedure carried out by individuals. It follows that such activity is not an activity of the State authorities and cannot therefore be treated in the same way as the activities referred to in Article 3(2), first indent, of Directive 95/46.
...
41. The words ‘personal or household’, within the meaning of [Article 3(2), second indent, of Directive 95/46], refer to the activity of the person processing the personal data and not to the person whose data are processed (see, to that effect, judgment of 11 December 2014, Rynes, C-212/13, EU:C:2014:2428, paragraphs 31 and 33).
42. As the Court held, Article 3(2), second indent, of Directive 95/46 must be interpreted as covering only activities that are carried out in the context of the private or family life of individuals. In that connection, an activity cannot be regarded as being purely personal or domestic where its purpose is to make the data collected accessible to an unrestricted number of people or where that activity extends, even partially, to a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner ...
...
44. In that connection, it is clear from the order for reference that door-to-door preaching, in the course of which personal data are collected by members of the Jehovah’s Witnesses Community, is, by its very nature, intended to spread the faith of the Jehovah’s Witnesses Community among people who, as the Advocate General observed in point 40 of his Opinion, do not belong to the faith of the members who engage in preaching. Therefore, that activity is directed outwards from the private setting of the members who engage in preaching.
45. Furthermore, it is also clear from the order for reference that some of the data collected by the members of that community who engage in preaching are sent by them to the congregations of that community which compile lists from that data of persons who no longer wish to receive visits from those members. Thus, in the course of their preaching, those members make at least some of the data collected accessible to a potentially unlimited number of persons.
...
49. However, although the door-to-door preaching activities of the member of a religious community is thereby protected by Article 10(1) of the Charter [of Fundamental Rights of the European Union] as an expression of the faith of those preachers, that fact does not confer an exclusively personal or household character on that activity, within the meaning of Article 3(2), second indent, of Directive 95/46.
50. Taking account of the considerations set out in paragraphs 44 and 45 of the present judgment, the preaching extends beyond the private sphere of a member of a religious community who is a preacher.
51. Having regard to the foregoing considerations ... Article 3(2) of Directive 95/46 ... read in the light of Article 10(1) of the Charter [of Fundamental Rights of the European Union], must be interpreted as meaning that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data does not constitute either the processing of personal data for the purpose of activities referred to in Article 3(2), first indent, of that directive or processing of personal data carried out by a natural person in the course of a purely personal or household activity, within the meaning of Article 3(2), second indent, thereof.”
21. As to whether personal data processing in relation to door-to-door preaching was tantamount to a “filing system” within the meaning of the Data Protection Directive, the CJEU stated:
“59. In the present case, it is clear from the findings of the referring court that the data collected in the course of the door-to-door preaching at issue in the main proceedings are collected as a memory aid, on the basis of an allocation by geographical sector, in order to facilitate the organisation of subsequent visits to persons who have already been contacted. They include not only information relating to the content of conversations concerning the beliefs of the person contacted, but also his name and address. Furthermore, those data, or at least a part of them, are used to draw up lists kept by the congregations of the Jehovah’s Witnesses Community of persons who no longer wish to receive visits by members who engage in the preaching of that community.
60. Thus, it appears that the personal data collected in the course of the door‑to‑door preaching at issue in the main proceedings are structured according to criteria chosen in accordance with the objective pursued by that collection, which is to prepare for subsequent visits and to keep lists of persons who no longer wish to be contacted. Thus, as it is apparent from the order for reference, those criteria, among which are the name and address of persons contacted, their beliefs or their wish not to receive further visits, are chosen so that they enable data relating to specific persons to be easily retrieved.
61. In that connection, the specific criterion and the specific form in which the set of personal data collected by each of the members who engage in preaching is actually structured is irrelevant, so long as that set of data makes it possible for the data relating to a specific person who has been contacted to be easily retrieved, which is however for the referring court to ascertain in the light of all the circumstances of the case in the main proceedings.
62. Therefore, ... Article 2(c) of Directive 95/46 must be interpreted as meaning that the concept of a ‘filing system’, referred to by that provision, covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use. In order for such a set of data to fall within that concept, it is not necessary that they include data sheets, specific lists or other search methods.”
22. As to whether a religious community (Jehovah’s Witnesses) could be regarded as a “controller” within the meaning of the Data Protection Directive, the CJEU stated:
“66. ... the existence of joint responsibility does not necessarily imply equal responsibility of the various operators engaged in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, so that the level of responsibility of each of them must be assessed with regard to all the relevant circumstances of the particular case ...
...
70. In the present case, as is clear from the order for reference, it is true that members of the Jehovah’s Witnesses Community who engage in preaching determine in which specific circumstances they collect personal data relating to persons visited, which specific data are collected and how those data are subsequently processed. However, as set out in paragraphs 43 and 44 of the present judgment, the collection of personal data is earned out in the course of door-to-door preaching, by which members of the Jehovah’s Witnesses Community who engage in preaching spread the faith of their community. That preaching activity is, as is apparent from the order for reference, organised, coordinated and encouraged by that community. In that context, the data are collected as a memory aid for later use and for a possible subsequent visit. Finally, the congregations of the Jehovah’s Witnesses Community keep lists of persons who no longer wish to receive a visit, from those data which are transmitted to them by members who engage in preaching.
71. Thus, it appears that the collection of personal data relating to persons contacted and their subsequent processing help to achieve the objective of the Jehovah’s Witnesses Community, which is to spread its faith and are, therefore, carried out by members who engage in preaching for the purposes of that community. Furthermore, not only does the Jehovah’s Witnesses Community have knowledge on a general level of the fact that such processing is carried out in order to spread its faith, but that community organises and coordinates the preaching activities of its members, in particular, by allocating areas of activity between the various members who engage in preaching.
72. Such circumstances lead to the conclusion that the Jehovah’s Witnesses Community encourages its members who engage in preaching to carry out data processing in the context of their preaching activity.
73. In the light of the file submitted to the Court, it appears that the Jehovah’s Witnesses Community, by organising, coordinating and encouraging the preaching activities of its members intended to spread its faith, participates, jointly with its members who engage in preaching, in determining the purposes and means of processing of personal data of the persons contacted, which is, however, for the referring court to verify with regard to all of the circumstances of the case.
75. Having regard to the foregoing considerations, ... Article 2(d) of Directive 95/46, read in the light of Article 10(1) of the Charter [of Fundamental Rights of the European Union], must be interpreted as meaning that it supports the finding that a religious community is a controller, jointly with its members who engage in preaching, for the processing of personal data carried out by the latter in the context of door-to‑door preaching organised, coordinated and encouraged by that community, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing.”
Judgment of the Supreme Administrative Court23. On 20 September 2018 the applicant community submitted its further submissions to the Supreme Administrative Court, requesting, inter alia, that an oral hearing be held before that court. According to the applicant community, an oral hearing was necessary because the Data Protection Directive had been replaced by the General Data Protection Regulation (see paragraph 41 below) and the relevant factual issues “ha[d] not been answered by the CJEU’s preliminary ruling” (reference was made to paragraphs 44, 62 and 73 of its judgment). In this connection, the applicant requested that an expert in religious matters (whose personal details were provided) and twenty-four individual Jehovah’s Witnesses be called to give evidence in court. A summary of their written statements was also submitted in support. It was further argued that the Board’s 2013 order (see paragraph 8 above) “violate[d] the rights of individual Jehovah’s Witnesses contrary to Articles 8, 9, 10 taken alone and in conjunction with Article 14 of the Convention and Article 1 of Protocol No. 12 to the Convention.” In this connection, the applicant community argued that “although comparable to activities which benefit[ed] from exemptions or derogations under Article 2(5) of the Personal Data Act ... the door-to-door preaching activity of Jehovah’s Witnesses had “received less favourable treatment ... without ‘any objective and reasonable justification’”
24. In a decision of 17 December 2018, which ran to sixty-seven pages and contained a detailed description of the parties’ submissions and the earlier decisions, the Supreme Administrative Court stressed that the decision of the Board only concerned the applicant community and that it would not rule on whether individual Jehovah’s Witnesses separately should be considered as controllers. The court quashed the Administrative Court’s decision in so far as it had annulled the Board’s decision, thereby bringing the latter into force. Referring to section 39 of the Administrative Judicial Procedure Act (see paragraph 38 below), the court rejected the applicant community’s request for an oral hearing since all twenty-four witnesses had already submitted their testimony in writing, which, as stated in the judgment, “ha[d] been taken into consideration when making the decision.”
25. As to the merits, the court, referring to the applicant community’s submissions and the witnesses’ written statements (some of whom confirmed that they made a brief note containing personal data in connection with a return visit or Bible study using an application on their electronic mobile device or using a paper notebook), noted that the content of the notes that individual Jehovah’s Witnesses might take during their door-to-door preaching varied according to the practices they adopted and the various situations they encountered in their preaching work. The notes could include the house number, the resident’s surname, if a certain address or resident at a certain address should not be visited again, and, in the case of return visits, a person’s first and/or last name, gender, address (possibly without the resident’s name or gender) or other contact details, the possible date of the next agreed visit and the possible topic of future discussion. Therefore, a significant part of the notes of individual Jehovah’s Witnesses could indisputably be considered personal data as defined in the Personal Data Act and could include sensitive data.
26. Referring to the above-mentioned findings of the CJEU, the court held that the collection of personal data by individual Jehovah’s Witnesses during their door-to-door preaching and the subsequent processing thereof could not be regarded as falling under the notion of processing of personal data which a private individual carried out for purely personal purposes or for comparable ordinary and private purposes. The fact that some individual Jehovah’s Witnesses might create friendships or acquaintanceships with some of the individuals whose personal data were in their notes, or that part of the personal data collected could be available from public sources, was immaterial. The court held it established that making notes containing personal data was related to the preparation of upcoming door-to-door preaching visits. Even though the methods and techniques used by each individual Jehovah’s Witness to record and organise personal data might differ, it stated that it would not make sense to take notes if, at the same time, the data were not being organised in such a manner to allow them to be found easily. Therefore, notes containing personal data in the form of paper documents or in electronic form on a mobile device (see paragraph 25 above) formed a personal data file, which meant that the Personal Data Act applied to the processing of such data.
27. The Supreme Administrative Court further noted that the making of notes containing personal data was significantly linked to door-to-door preaching for the purpose of spreading one’s faith. Referring to the findings of the CJEU as to whether a community can be considered a data controller, the court established that in the present case door-to-door preaching was organised and coordinated by maintaining territory maps/cards. Even if individual Jehovah’s Witnesses themselves decided the territory in which they would be engaging in door-to-door preaching, this did not mean that the applicant community could not be viewed as participating in the distribution of operational areas for door-to-door preaching. The congregations of the applicant community maintained publisher cards recording how many of the community’s publications a member had distributed and how much time he or she had spent on evangelism. Reference was also made to the leaflet containing instructions on how to make notes, as well as the fact that the congregational territory maps/cards contained personal data about people who did not wish Jehovah’s Witnesses to visit them. Even though door‑to‑door preaching was also part of the personal religious activity of individual Jehovah’s Witnesses, the aforementioned showed that it was actually organised, coordinated and encouraged by the applicant community. Accordingly, the applicant community had actually taken part in determining the purposes and means of the processing of personal data, and it had to be viewed as a controller of the personal data files created in the course of door‑to-door preaching jointly with individual Jehovah’s Witnesses who took notes containing personal data. As a controller, the applicant community was responsible for the requirements of the Personal Data Act being met.
28. As the processing of personal data in the course of door-to-door preaching was not based on a registered customer relationship or membership or other similar relationship, it required the unambiguous consent of the data subject. Such consent was not established by, for example, a person not refusing a return visit or agreeing to one. It appeared from the case file that individual Jehovah’s Witnesses, at least in general, did not ask for the express consent of the data subject for the processing of personal data, nor did the case file show that the applicant community instructed them to do so. Therefore, the processing of personal data in the course of door-to-door preaching did not meet the requirements of sections 8 and 12 of the Personal Data Act. The Board had therefore been right in prohibiting the applicant community from collecting and processing personal data in the context of door-to-door preaching and in obliging the applicant community to ensure that no personal data were collected in violation of the Personal Data Act. For that order to be valid, it was not necessary that all or even the majority of Jehovah’s Witnesses made notes containing personal data in their door‑to‑door preaching.
29. The Supreme Administrative Court further noted as follows:
“the decision does not mean that personal data cannot be processed in any circumstances in the context of door-to-door preaching, but that the processing of such data must meet the requirements of the Personal Data Act.
Religious communities and religious activities are not exempted from complying with the provisions on the processing of personal data in the Personal Data Act. Moreover, requiring compliance with the Personal Data Act cannot be viewed as limiting the right to privacy or freedom of expression of the [applicant community] or individual Jehovah’s Witnesses guaranteed by the Constitution of Finland, the European Convention on Human Rights and the Charter of Fundamental Rights of the European Union. The above-mentioned rights also belong to people whose personal data are being processed, and they have the right to expect that provisions regarding the processing of personal data be complied with.
The decision of the Data Protection Board was not made ... in an attempt to hinder the religious practices of individual Jehovah’s Witnesses; rather, it was made for reasons having to do with the processing of personal data. The decision does not subject the Community or individual Jehovah’s Witnesses to different treatment in comparison with other religious communities or their members, and does not violate the provisions and regulations on the prohibition of discrimination ...”
Relevant legal framework and practice
Domestic lawA. Personal Data Act (henkilötietolaki, personuppgiftslag; 523/1999)
30. The Personal Data Act was in force until 31 December 2018 (it was repealed by the Data Protection Act, which entered into force on 1 January 2019, see paragraph 37 below). Its aim was to ensure the protection of private life and the other fundamental rights which safeguard the right to privacy (section 1).
31. Section 2(3) and (5) provided that the Act did not apply to the processing of personal data by a private individual for purely personal purposes or for comparable ordinary and private purposes, or to the processing of personal data for purposes of journalism or artistic or literary expression.
32. Section 3(1) and (4) provided that:
“(1) personal data means any information on a private individual and any information on his or her personal characteristics or personal circumstances, where these are identifiable as concerning him or her or the members of his or her family or household;
...
(4) controller means a person, corporation, institution or foundation, or a number of them, for the use of whom a personal data file is set up and who is entitled to determine the use of the file, or who has been designated as a controller by an Act;”
33. Section 8(1) provided that:
“Personal data shall be processed only if:
(1) the data subject has unambiguously consented to the same;
(2) the data subject has given authorisation for the same, or this is necessary in order to perform a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract;
(3) processing is necessary, in an individual case, in order to protect the vital interests of the data subject;
(4) processing is based on the provisions of an Act or it is necessary for compliance with a task or obligation to which the controller is bound by virtue of an Act or an order issued on the basis of an Act;
(5) there is a relevant connection between the data subject and the operations of the controller, based on the data subject being a client or member of, or in the service of, the controller or on a comparable relationship between the two (connection requirement);
(6) the data relate to the clients or employees of a group of companies or another comparable economic grouping, and they are processed within the said grouping;
(7) processing is necessary for purposes of payment traffic, computing or other comparable tasks undertaken on the assignment of the controller;
(8) the matter concerns generally available data on the status, duties or performance of a person in a public corporation or business, and the data are processed in order to safeguard the rights and interests of the controller or a third party receiving the data; or
(9) the Data Protection Board has issued the permission referred to in section 43(1).”
34. Section 11 prohibited the processing of sensitive data. Personal data were considered sensitive if they related to or were intended to relate to, inter alia, race or ethnic origin; the social, political or religious affiliation or trade-union membership of a person; or the state of health, illness or disability of a person or the treatment or other comparable measures directed at him or her.
35. However, section 12(1) provided as follows:
“The prohibition in section 11 does not prevent:
“(1) [the] processing of data where the data subject has given express consent;
(2) [the] processing of data on the social, political or religious affiliation or trade‑union membership of a person, where the person has him or herself brought the data into the public domain;
(3) [the] processing of data necessary for the safeguarding of a vital interest of the data subject or someone else, if the data subject is incapable of giving his or her consent;
...
(7) [the] processing of data on religious, political or social affiliation in the operations of an association or corporation professing such affiliation, where the data relate to members of the association or corporation or to persons connected to the association or corporation on a regular basis and in the context of the stated purposes of the association or corporation, and where the data are not disclosed to a third party without the consent of the data subject;
...
(13) [the] processing of data where the Data Protection Board has issued the permission referred to in section 43(2).”
B. Data Protection Act (tietosuojalaki, dataskyddslag; 1050/2018)
36. Section 24(5) provides that an administrative fine cannot be imposed, inter alia, on the Evangelical Lutheran Church of Finland and the Orthodox Church of Finland or their parishes, parish unions and other bodies.
37. The Data Protection Act entered into force on 1 January 2019 and repealed, inter alia, the Personal Data Act (523/1999) (section 37).
C. Administrative Judicial Procedure Act (hallintolainkäyttölaki; förvaltningsprocesslag; 586/1996)
38. The relevant provisions of the Administrative Judicial Procedure Act concerning an oral hearing in administrative proceedings read as follows:
Section 37 – Oral hearing
“(1) Where necessary, an oral hearing shall be conducted for purposes of establishing the facts of the case ...”
Section 38 – Oral hearing at the request of a party
“(1) An Administrative Court shall conduct an oral hearing if a private party so requests. The same applies to the Supreme Administrative Court where it is considering an appeal against the decision of an administrative authority. The oral hearing requested by a party need not be conducted if the claim is dismissed without considering its merits or immediately rejected or if an oral hearing is manifestly unnecessary in view of the nature of the matter or for another reason.
...
(3) If a party requests an oral hearing, he shall state why the conduct thereof is necessary and what evidence he would present in the oral hearing.”
Section 39 – Hearing of witnesses
(as amended by Act 799/2015, entered into force on 1 January 2016)
“Witnesses who have been called by a party or the administrative authority that made the decision, or the hearing of whom the appellate authority considers necessary, may be heard in an oral hearing. If written evidence of a private nature is relied on in the matter, the witness shall be heard in person only if this is necessary in order to clarify the matter.”
INTERNATIONAL LAWThe Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data39. The relevant provisions of the Data Protection Convention (which entered into force on 1 October 1985) are cited in L.B. v. Hungary ([GC], no. 36345/16, §§42-43, 9 March 2023).
Directive 95/46/EC of the European Parliament and of the Council [of the European Union] of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281, 23/11/199540. The relevant parts of the Data Protection Directive read as follows:
Article 2
Definitions
“For the purposes of this Directive:
(a) ‘personal data’ shall mean any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified , directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) ‘processing of personal data’ (‘processing’) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c) ‘personal data filing system’ (‘filing system’) shall mean any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralised or dispersed on a functional or geographical basis;
(d) ‘controller’ shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
...”
Article 3
Scope
“...
2. This Directive shall not apply to the processing of personal data:
- in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
- by a natural person in the course of a purely personal or household activity.”
Article 7
“Member States shall provide that personal data may be processed only if:
(a) the data subject has unambiguously given his consent; or
...”
Article 9
Processing of personal data and freedom of expression
“Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.”
Regulation (EU) 2016/679 of the European Parliament and of the Council [of the European Union] of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Official Journal L 119, 04.05.201641. The relevant parts of the General Data Protection Regulation read as follows:
Article 2
Material scope
“ ...
2. This Regulation does not apply to the processing of personal data:
(a) in the course of an activity which falls outside the scope of Union law;
(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;
(c) by a natural person in the course of a purely personal or household activity;
(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
...”
Article 4
Definitions
“For the purposes of this Regulation:
...
(6) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
...”
THE LAW
Alleged violation of Article 6 of the Convention42. The applicant community complained about the lack of an oral hearing in the domestic proceedings. It alleged a violation of its rights under Article 6 § 1, the relevant part of which reads as follows:
“In the determination of his civil rights and obligations ... everyone is entitled to a fair ... hearing ... by [a] ... tribunal ...”
Admissibility43. The Government did not raise any objection as regards the admissibility of this complaint.
44. The Court concludes that the complaint under this head is not manifestly ill-founded within the meaning of Article 35 § 3 (a) of the Convention. No other ground for declaring it inadmissible has been established. It must therefore be declared admissible.
MeritsThe parties’ submissions(a) The Government
45. The Government submitted that the applicant community had not sought an oral hearing before the Board. They claimed that both the Administrative Court and the Supreme Administrative Court had provided adequate reasons for dispensing with such a hearing. The Supreme Administrative Court had taken into account the written statements of the witnesses proposed by the applicant community and had found it unnecessary to hear oral evidence from them. An oral hearing would not have produced any evidence that could not have been obtained in writing. Neither the credibility nor the assessment of evidence had been of particular significance for the outcome of the case. The applicant community had been given ample opportunity to put forward its case in writing and comment on the authorities’ submissions. The Government also referred to the findings of the CJEU regarding the applicant community’s requests to reopen the oral phase of the proceedings before that court (see paragraph 19 above).
(b) The applicant community
46. The applicant community argued that the case was sufficiently complex and fact dependent to have warranted an oral hearing. However, there had been no such hearing before any domestic court, despite the fact that it had requested one in the proceedings before the Administrative Court and the Supreme Administrative Court. In addition, the facts of the case had been in dispute and the Government did not argue that there had been “exceptional circumstances” that justified dispensing with an oral hearing. Referring to the preliminary ruling proceedings before the CJEU, the applicant community alleged that it had not been allowed to provide a response to key questions raised by the judge rapporteur or to the arguments raised by the Government in those proceedings. That there had been an oral hearing in the proceedings before the CJEU could not be considered an adequate substitute for an oral hearing before the domestic courts.
The Court’s assessment47. For the principles applicable to the right to a public hearing, the Court would refer to its judgment in Ramos Nunes de Carvalho e Sá v. Portugal [GC], nos. 55391/13 and 2 others, §§ 187-92, 6 November 2018).
48. The Court has identified the following situations in which exceptional circumstances may justify dispensing with a hearing (ibid., § 190, with further references):
where there are no issues of credibility or contested facts which necessitate a hearing, and the courts may fairly and reasonably decide the case on the basis of the case file;
in cases raising purely legal issues of limited scope, or points of law of no particular complexity;
where the case concerns highly technical issues; for instance, the Court has taken into consideration the technical nature of disputes concerning social-security benefits, which may be better dealt with in writing than in oral argument.
49. By contrast, the Court has found the holding of a hearing to be necessary in certain cases (ibid., § 191, with further references).
Where there is a need to assess whether the facts were correctly established by the authorities.
Where the court needs to obtain clarification on certain points, inter alia, by means of a hearing.
Where the circumstances require the court to form its own impression of litigants by affording them a right to explain their personal situation, in person or through a representative. As found in De Tommaso v. Italy ([GC], no. 43395/09, § 167, 23 February 2017), this may encompass aspects such as the applicant’s character, behaviour and dangerousness, when these aspects were decisive for the imposition of the impugned measure.
50. Turning to the present case, the Court notes at the outset that it will confine its examination of the complaint under this head only to the proceedings before the domestic authorities. In this connection, it notes that no oral hearing was held at any stage of the domestic proceedings. It will therefore need to examine whether there were exceptional circumstances, as set out in the Court’s case-law, in the present case that justified dispensing with an oral hearing.
51. The Court observes that the applicant community did not request such a hearing in the proceedings before the Board. In its appeal of 17 October 2013 against the Board’s decision, the applicant community requested that the Administrative Court hold an oral hearing in order to present certain evidence and supplement the reasoning presented in the written submissions (see paragraph 12 above). However, it did not specify what evidence it wished to present at the hearing, as required by section 38(3) of the Administrative Judicial Procedure Act (see paragraph 38 above). Nor did it explain why it was necessary to submit that evidence, as well as the additional legal arguments, at a hearing and not in writing. Notwithstanding these omissions on the part of the applicant community, the Administrative Court examined the request and, referring to section 38(2) of the Act, decided to dispense with an oral hearing (see, conversely, Mirovni Inštitut v. Slovenia, no. 32303/13, §§ 44 and 45, 13 March 2018). Firstly, it held that there was no need for an oral hearing regarding the complaints that it dismissed without considering them on the merits (the appeal submitted by two individual Jehovah’s Witnesses and the issues regarding the use of form S-43, which the applicant community had withdrawn). Secondly, it held that an oral hearing regarding the remaining part of the appeal was manifestly unnecessary in view of the outcome of the case, which was to the applicant community’s benefit. The Court does not find this reasoning untenable.
52. As regards the proceedings before the Supreme Administrative Court, the Court notes that the applicant community did not request a hearing in its first observations of 20 April 2015 submitted in reply to the Ombudsman’s appeal (see paragraph 16 above). Such a request was first made in the last round of submissions to that court, dated 20 September 2018, which followed the preliminary ruling proceedings before the CJEU (see paragraph 23 above). A hearing was sought because the “relevant factual issues” pertaining to the nature of door-to-door preaching by members of the Jehovah’s Witnesses Community, the concept of a “filing system” referred to by the Data Protection Directive and its participation in the processing of the personal data of the persons contacted “ha[d] not been answered by the CJEU’s preliminary ruling” (see paragraph 23 above). The applicant’s request was accompanied by the written testimony of twenty‑four individual Jehovah’s Witnesses whom the applicant community wished to call.
53. The Supreme Administrative Court did not find it necessary to hold a hearing in order to hear those named orally as witnesses, as their statements were taken into account as written evidence. Indeed, that court referred expressly to the witnesses’ written statements in order to establish the content of the notes, as well as the methods and techniques used by individual Jehovah’s Witnesses to record and organise the personal data of data subjects (see paragraphs 25 and 26 above). In doing so, the court referred to section 39 of the Administrative Judicial Procedure Act, which gave the administrative courts latitude to consider whether hearing a witness was necessary in the circumstances of a case (see paragraph 38 above).
54. The Court further reiterates that the absence of a hearing before a second or third-instance court must be examined in the light of the entirety of the proceedings (see Juričić v. Croatia, no. 58222/09, § 89, 26 July 2011), and all relevant circumstances. In this connection, it observes that the practice regarding the collection and processing of personal data in the context of door-to-door preaching by individual Jehovah’s Witnesses was the subject of debate at national level for many years and that the proceedings involving the applicant community started at the latest in 2011 and ended on 17 December 2018, when the Supreme Administrative Court gave a final decision in the case (see paragraphs 5 and 24 above). During the proceedings, the applicant community availed itself of the opportunity, at each level of jurisdiction, to adduce evidence and submit its arguments on all points of fact and law (see paragraphs 5, 7, 12, 16 and 23 above). This was also the case in the preliminary ruling proceedings before the CJEU, which consisted of both written and oral phases (see paragraphs 18 and 19 above).
55. It is to be noted that the preliminary ruling from the CJEU was requested by the Supreme Administrative Court, as the court of last instance at national level, in the light of the entire evidential material and legal arguments adduced until that moment. The CJEU considered that “it ha[d] all the evidence necessary to enable it to reply to the questions referred” and that “the order for reference contain[ed] sufficient factual and legal information to understand both the questions referred for a preliminary ruling and their scope” (see paragraph 19 above). Repeatedly noting as “clear from the order for reference” and “clear from the findings of the referring court”, the CJEU reached important conclusions of fact and law relevant for its judgment (see paragraphs 19-22 above). It noted, inter alia, that “some of the data collected by the members of that community who engage[d] in preaching [were] sent by them to the congregations of that community which compile[d] lists from that data of persons who no longer wish[ed] to receive visits from those members” (see paragraph 45 thereof) and, in this connection, that such data “[were] collected as a memory aid, on the basis of an allocation by geographical sector, in order to facilitate the organisation of subsequent visits to persons who ha[d] already been contacted. They include[d] not only information relating to the content of conversations concerning the beliefs of the person contacted, but also his name and address. Furthermore, those data ... [were] used to draw up lists kept by the congregations of the Jehovah’s Witnesses Community of persons who no longer wish[ed] to receive visits by members who engage[d] in the preaching of that community” (see paragraph 59 thereof, see similar conclusion in paragraph 70 thereof). Similarly, it concluded that “(door-to-door) preaching [was] ... organised, coordinated and encouraged by that community ...” and that it “organise[d] and coordinate[d] the preaching activities of its members, in particular, by allocating areas of activity between the various members who engage[d] in preaching” (see paragraphs 70 and 71 thereof).
56. The above findings coincide with the facts established by the national authorities regarding the existence and content of the notes taken by individual Jehovah’s Witnesses during their door-to-door preaching and the related leaflet published by the applicant community, namely that such data served as a memory aid for return visits of people who had shown interest, or assisted the creation of the so-called “prohibition register” for people who no longer wished to receive visits, and amounted, accordingly, to a retrievable personal data file, and that door-to-door preaching was organised, coordinated and encouraged by the applicant community according to territory (see paragraphs 8, 9, 10, 17, 25, 26 and 27 above). It is noteworthy that the above findings in the domestic proceedings were either not contested by the applicant community or explicitly acknowledged by the latter. Indeed, the applicant community had admitted that local congregations of Jehovah’s Witnesses maintained a “manual filing system” containing personal data about people who wished not to be visited by Jehovah’s Witnesses (see paragraph 5 above) and that notes made by individual Jehovah’s Witnesses during their door-to-door preaching “served ... as a ‘memory aid’ when revisiting those who show[ed] interest” (see paragraphs 12 and 16 above). Similarly, it confirmed that it maintained a territory map which “aimed to enable orderly contact with residents in the community” (see paragraph 18 above). Indications that the applicant community “encourage[d]” individual Witnesses to participate in preaching activities and that their notes assisted them to contact and visit people in an organised manner can be found in its appeal against the Board’s decision (see paragraph 12 above).
57. In such circumstances, and in the absence of any argument pertaining to the credibility of the evidence, it cannot be said that the decisive facts on which the order was based were in dispute between the parties and that they warranted an oral hearing. Furthermore, the Court is satisfied that the legal issues at stake, which were at the core of the proceedings, did not require an oral hearing and that the written procedure provided the applicant community with an opportunity to effectively put forward its arguments (see Jussila v. Finland [GC], no. 73053/01, § 48, ECHR 2006‑XIV). There were therefore exceptional circumstances which justified dispensing with an oral hearing.
58. There has accordingly been no violation of Article 6 of the Convention on account of the lack of an oral hearing in the impugned proceedings.
II. Alleged violation of Article 9 of the Convention
59. The applicant community complained that the Board’s order prohibiting any notes being taken by individual Jehovah’s Witnesses for their personal use in the context of their door-to-door preaching activities without the consent of the data subject had violated its rights under Articles 9 and 10 of the Convention.
60. The relevant provisions read as follows:
Article 9 (freedom of thought, conscience and religion)
“1. Everyone has the right to freedom of thought, conscience and religion; this right includes freedom to change his religion or belief and freedom, either alone or in community with others and in public or private, to manifest his religion or belief, in worship, teaching, practice and observance.
2. Freedom to manifest one’s religion or beliefs shall be subject only to such limitations as are prescribed by law and are necessary in a democratic society in the interests of public safety, for the protection of public order, health or morals, or for the protection of the rights and freedoms of others.”
Article 10 (freedom of expression)
“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.
2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”
Preliminary remarks on the scope and context of the Court’s assessment61. In the domestic proceedings, the applicant community argued that door-to-door preaching, in the course of which individual Jehovah’s Witnesses might take certain notes, had to be seen in the context of freedom of religion, and referred explicitly to Article 9 of the Convention (see paragraphs 7, 12 and 16 above). The national authorities also held that notes containing personal data could be taken in the course of the door-to-door preaching, a religious activity aimed at manifesting or spreading the faith of Jehovah’s Witnesses (see paragraphs 10, 14 and 27 above). That conclusion overlaps with the findings of the CJEU that “... the collection of personal data by members of the Jehovah’s Witnesses Community in the course of door-to-door preaching [was] a religious procedure carried out by individuals” and “that door-to-door preaching, in the course of which personal data [were] collected by members of the Jehovah’s Witnesses Community, [was], by its very nature, intended to spread the faith of the Jehovah’s Witnesses Community ...” (see paragraph 20 above).
62. Given that the applicant community’s religious freedom, in particular the freedom to manifest its faith, as enshrined in Article 9 of the Convention is at the heart of its grievances, the Court, being the master of the characterisation to be given in law to the facts of the case (see Radomilja and Others v. Croatia [GC], no. 37685/10, § 124, 20 March 2018, and Söderman v. Sweden [GC], no. 5786/08, § 57, ECHR 2013), considers that the complaint under this head should be analysed only under Article 9 of the Convention, which, in the circumstances, is to be considered lex specialis with regard to Article 10.
63. Furthermore, it considers that at the heart of the present case lies the question of whether the correct balance was struck between that right and the right to privacy of data subjects as embodied in domestic data protection legislation and as protected under Article 8 of the Convention. Indeed, it follows from the applicable law, the parties’ arguments and the approach applied by the national authorities, in particular the Supreme Administrative Court (see paragraphs 16 and 29-35 above and paragraphs 67 and 71 below), that the balancing exercise should focus on the Article 8 rights of data subjects and the Article 9 rights of the applicant community. For these reasons, the Court will outline some of the general principles deriving from the Court’s case-law on Article 9, on the one hand, and the right to privacy under Article 8 in the particular context of data protection, on the other (see paragraphs 72-78 below).
Admissibility64. The Government did not raise any specific objection as to the admissibility of this part of the application and only maintained that it was manifestly ill-founded.
65. The Court notes that this part of the application is not manifestly ill‑founded within the meaning of Article 35 § 3 (a) of the Convention. It further notes that it is not inadmissible on any other grounds. It must therefore be declared admissible.
MeritsThe parties’ submissions(a) The Government
66. The Government maintained that the applicant community had not been prohibited from taking notes containing personal data linked to its door-to-door preaching activity, but that it had to ensure that the processing of such data was done in accordance with the Personal Data Act, for instance, by asking for the consent of the person to whom the personal data related. The requirement of consent could not be deemed to amount to an interference within the meaning of Article 9 of the Convention as the applicant community had not been prohibited from manifesting its religion or belief either alone or in community with others. Even if the Court were to consider that there had been an interference, it had been prescribed by law and had been necessary in a democratic society in the interests of the protection of the rights and freedoms of others.
67. The relevant order had been based on the Personal Data Act in force at the time of the proceedings. That law was formulated with sufficient precision and aimed to protect the rights and freedoms of others. The Supreme Administrative Court had taken into account the fact that individuals whose personal data had been collected were entitled to trust that their data were not collected without their knowledge and consent. They also had a legitimate expectation, guaranteed by law, that they would have access to the data and, if necessary, the right to require that the data be corrected or deleted. Ensuring the rights of data subjects therefore inspired confidence rather than distrust in the applicant community’s activities. The consent requirement and the fact that it did not interfere with the core areas of the applicant community’s freedom of religion or freedom of expression had thus been proportionate.
68. Any processing of personal data had to be justifiable by some criterion laid down by law, and the prior publicity of personal data was not such a criterion. Even where information about some personal data was publicly available (such as the person’s name, address or telephone number), this did not mean that such data could be freely processed. Although the Personal Data Act was applicable to the applicant community, it had not restricted its freedom of religion or its right to freedom of expression, including the right to impart information and ideas.
(b) The applicant community
69. The applicant community maintained that no examples of notes allegedly violating the Personal Data Act had been adduced in evidence during the domestic proceedings. However, it confirmed that individual Jehovah’s Witnesses might choose to make a personal, private note when no one was at home, when an occupant asked that no further visits be made and if an occupant requested or agreed to a “return visit” or “Bible study”.
70. It argued that the interference under Article 9 of the Convention had not been “prescribed by law” since the Supreme Administrative Court had wrongly applied domestic law when it had held that the exemption for the processing of personal data for purely personal purposes or for comparable ordinary and private purposes did not apply to a note taken by Jehovah’s Witnesses, and when it had concluded that Jehovah’s Witnesses engaged in their individual evangelism on behalf of and for the benefit of the applicant community. Their door-to-door evangelism was a hallmark of their individual religious activity, and the applicant community was a legal entity with the sole function of supporting their “deeply personal religious activity”, such as by importing religious literature and renting or owning properties for religious services. Similarly, it had been wrong to hold that the applicant community was the “controller” jointly with individual Jehovah’s Witnesses who took notes containing personal data. Any personal data included in a note was not shared with anyone.
71. Furthermore, the applicant community maintained that the interference had not pursued a pressing social need. The privacy interests of people whose personal data were noted down were either non-existent or de minimis as such information was publicly available. The recording of conversations by an interlocutor and the private use of such recordings did not violate Article 8 of the Convention per se. The interference had also been excessive and disproportionate, impeding the personal expression of faith and dialogue integral to a free exchange of religious, atheistic, agnostic and philosophical ideas or views. It was disproportionate to require, when taking a brief note containing personal data, that an individual Jehovah’s Witness first establish a legal basis for doing so by obtaining the “consent” of the interlocutor, then provide him or her with the identity of the “controller”, explain to him or her the purpose of the processing of the data, and then explain the right of access, rectification and erasure, in addition to complying with the many other requirements applicable to “controllers”. It was impossible to obtain consent when occupants were not at home. Even when an occupant agreed to a follow-up visit, asking for consent would have a chilling effect, subjecting private religious conversations to suspicion and distrust, and creating an erroneous and stigmatising impression that the evangelism was a de facto marketing endeavour. The applicant community further argued that the State had failed to provide “convincing and compelling reasons” for the interference.
The Court’s assessment(a) General principles
(i) Article 9 of the Convention
72. The freedom of thought, conscience and religion, as enshrined in Article 9 and as acknowledged in the Court’s case-law, is one of the foundations of a “democratic society” within the meaning of the Convention. This freedom is, in its religious dimension, one of the most vital elements that go to make up the identity of believers and their conception of life, but it is also a precious asset for atheists, agnostics, sceptics and the unconcerned. The pluralism indissociable from a democratic society, which has been dearly won over the centuries, depends on it. That freedom entails, inter alia, freedom to hold or not to hold religious beliefs and to practise or not to practise a religion (see, among other authorities, Kokkinakis v. Greece, 25 May 1993, § 31, Series A no. 260-A; Buscarini and Others v. San Marino [GC], no. 24645/94, § 34, ECHR 1999-I; S.A.S. v. France [GC], no. 43835/11, § 124, ECHR 2014 (extracts); and İzzettin Doğan and Others v. Turkey [GC], no. 62649/10, § 103, 26 April 2016).
73. Religious freedom is primarily a matter of individual thought and conscience. This aspect of the right set out in the first paragraph of Article 9, to hold any religious belief and to change religion or belief, is absolute and unqualified. However, as further set out in Article 9 § 1, freedom of religion also encompasses the freedom to manifest one’s belief alone and in private but also to practise in community with others and in public. The manifestation of religious belief may take the form of worship, teaching, practice and observance. Bearing witness in words and deeds is bound up with the existence of religious convictions (see Kokkinakis, cited above, § 31; and Leyla Şahin v. Turkey [GC], no. 44774/98, § 105, ECHR 2005-XI). Since the manifestation by one person of his or her religious belief may have an impact on others, the drafters of the Convention qualified this aspect of freedom of religion in the manner set out in Article 9 § 2. This second paragraph provides that any limitation placed on a person’s freedom to manifest religion or belief must be prescribed by law and necessary in a democratic society in pursuit of one or more of the legitimate aims set out therein (see Eweida and Others v. the United Kingdom, nos. 48420/10 and 3 others, § 80, ECHR 2013 (extracts)).
74. The fundamental nature of the rights guaranteed in Article 9 § 1 of the Convention is also reflected in the wording of the paragraph providing for limitations on them. Unlike the second paragraphs of Articles 8, 10 and 11 of the Convention, which cover all the rights mentioned in the first paragraphs of those Articles, that of Article 9 refers only to “freedom to manifest one’s religion or belief”. In so doing, it recognises that in democratic societies, in which several religions coexist within one and the same population, it may be necessary to place restrictions on this freedom in order to reconcile the interests of the various groups and ensure that everyone’s beliefs are respected (see Kokkinakis, cited above, § 33). At the same time, it emphasises the primary importance of the right to freedom of thought, conscience and religion and the fact that a State cannot dictate what a person believes or take coercive steps to make him change his beliefs (see Ivanova v. Bulgaria, no. 52435/99, § 79, 12 April 2007).
75. The Court also reiterates that freedom to manifest one’s religion includes in principle the right to express one’s religious views by imparting them with others and the right “to try to convince one’s neighbour”, for example through “teaching”, failing which “freedom to change [one’s] religion or belief”, enshrined in Article 9, would be likely to remain a dead letter (see Kokkinakis, cited above, § 31). The act of imparting information about a particular set of beliefs to others who do not hold those beliefs – known as missionary work or evangelism in Christianity – is protected under Article 9 alongside with other acts of worship, such as the collective study and discussion of religious texts, which are aspects of the practice of a religion or belief in a generally recognised form (see Kokkinakis, cited above, § 48, and Kuznetsov and Others v. Russia, no. 184/02, § 57, 11 January 2007).
(ii) Article 8 of the Convention, the right to privacy and data protection
76. The Court reiterates that the concept of “private life” is a broad term not susceptible to exhaustive definition (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 66, ECHR 2008, and Vukota-Bojić v. Switzerland, no. 61838/10, § 52, 18 October 2016). Private life has been held to include, inter alia, the right to live privately, away from unwanted attention (see Smirnova v. Russia, nos. 46133/99 and 48183/99, § 95, ECHR 2003 IX (extracts)). Indeed, the Court has held that there is a zone of interaction of a person with others, even in a public context, which may fall within the scope of “private life” for the purposes of Article 8 of the Convention (see Couderc and Hachette Filipacchi Associés v. France [GC], no. 40454/07, § 83, ECHR 2015 (extracts), and P.G. and J.H. v. the United Kingdom, no. 44787/98, § 56, ECHR 2001-IX).
77. The Court reiterates that the right to protection of personal data is guaranteed by the right to respect for private life under Article 8 (see, most recently, L.B., cited above, §103). In this context, the Court has, on a number of occasions, referred to the Data Protection Convention (see paragraph 39 above), which itself underpins the Data Protection Directive relevant for the present case. That Convention, like the Data Protection Directive (see paragraph 40 above), defines personal data in Article 2 as “any information relating to an identified or identifiable individual” (see Amann v. Switzerland [GC], no. 27798/95, § 65, ECHR 2000-II).
78. Where there has been compilation of data on a particular individual, processing or use of personal data or publication of the material concerned in a manner or degree beyond that normally foreseeable, private life considerations arise (see Uzun v. Germany, no. 35623/05, §§ 44-46, ECHR 2010 (extracts); see also Rotaru v. Romania [GC], no. 28341/95, §§ 43-44, ECHR 2000‑V; P.G. and J.H. v. the United Kingdom, cited above, § 57; Amann, cited above, §§ 65-67; and M.N. and Others v. San Marino, no. 28005/12, §§ 52-53, 7 July 2015).
79. The protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Domestic law must afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article (see S. and Marper, cited above, § 103). Article 8 thus provides for the right to a form of informational self-determination, allowing individuals to rely on their right to privacy as regards data which, albeit neutral, are collected, processed and disseminated collectively and in such a form or manner that their Article 8 rights may be engaged (see Satakunnan Markkinapörssi Oy and Satamedia Oy, cited above, § 137).
(b) Application to the present case
(i) Existence of an interference
80. The Court notes that the applicant community was prohibited from collecting and processing the personal data of data subjects in connection with the door-to-door preaching of its adherents to the extent that that activity did not meet the requirements of sections 8 and 12 of the Personal Data Act. In particular, door-to-door preaching required the unambiguous or express consent of data subjects when personal and sensitive data, within the meaning of sections 3(1) and 11 of the Personal Data Act (see paragraphs 32 and 34 above), were being collected and processed. The Board stated that its order did not prohibit door-to-door preaching per se (see paragraph 8 above). Nor did it mean, as held by the Supreme Administrative Court, that “personal data [could] not be processed in any circumstances in the context of door-to-door preaching” (see paragraph 29 above).
81. The Court is ready to accept that the application of the consent requirement to the collection and processing of personal and sensitive data in the course of door-to-door preaching, a religious activity intended to manifest or spread the faith of the Jehovah’s Witnesses (see paragraph 62 and 63 above), constituted an interference with the applicant community’s rights under Article 9 of the Convention.
82. In the light of paragraph 2 of Article 9, such an interference must be “prescribed by law”, have one or more legitimate aims and be “necessary in a democratic society”.
(ii) Prescribed by law
83. It is undisputed by the parties that the impugned interference had a legal basis in the Personal Data Act, as in force at the material time. However, the applicant community claimed that the Supreme Administrative Court had wrongly applied domestic law to the circumstances of the case (see paragraph 70 above). The Government, for their part, submitted that the Personal Data Act was formulated with sufficient precision (see paragraph 67 above).
84. The Court reiterates its established case-law as to the meaning of the term “prescribed by law” under Article 9 of the Convention and the quality requirements the domestic law needs to satisfy. It further reiterates that the role of adjudication vested in the national courts is precisely to dissipate any interpretational doubts; the Court’s power to review compliance with domestic law is thus limited, as it is primarily for the national authorities, notably the courts, to interpret and apply domestic law (see Kudrevičius and Others v. Lithuania [GC], no. 37553/05, §§ 108-10, ECHR 2015, with further references).
85. The Court observes that the Personal Data Act transposed the Data Protection Directive into Finnish law (see paragraph 14 above). Before the Supreme Administrative Court reached its final conclusion on the matter, it sought guidance from the CJEU on the interpretation of the Data Protection Directive. The Court has regularly emphasised the importance, for the protection of fundamental rights in the EU, of the judicial dialogue conducted between the domestic courts of EU member States and the CJEU in the form of references from the former for preliminary rulings by the latter (see Bosphorus Hava Yolları Turizm ve Ticaret Anonim Şirketi v. Ireland [GC], no. 45036/98, § 164, ECHR 2005‑VI; Avotiņš v. Latvia [GC], no. 17502/07, §§ 105 and 109, ECHR 2016; and Satakunnan Markkinapörssi Oy and Satamedia Oy, cited above, § 150).
86. In the judgment of 10 July 2018, the CJEU gave an authoritative interpretation of the Data Protection Directive relevant for the main legal issues contested by the applicant community. In particular, it held “that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data [did] not constitute ... the processing of personal data carried out by a natural person in the course of a purely personal or household activity, within the meaning of Article 3(2), second indent, [of the Data Protection Directive]” (see paragraph 20 above). The Court notes that an identical exemption was included in section 2(3) of the Personal Data Act (see paragraph 31 above). The CJEU also held that “a religious community [was] a controller, jointly with its members who engage[d] in preaching, for the processing of personal data carried out by the latter in the context of door-to-door preaching organised, coordinated and encouraged by that community, without it being necessary that the community ha[d] access to those data, or to establish that that community ha[d] given its members written guidelines or instructions in relation to the data processing” (see paragraph 22 above). Lastly, it confirmed that “the concept of a ‘filing system’, referred to by [Article 2(c) of the Data Protection Directive], cover[ed] a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data [were] structured according to specific criteria which, in practice, enable[d] them to be easily retrieved for subsequent use” (see paragraph 21 above).
87. Following the CJEU’s guidance, the Supreme Administrative Court provided a similar interpretation of the relevant provisions of the Personal Data Act and applied them taking account of the established facts relevant for the present case (see paragraphs 55 and 56 above). Even if the applicant community’s case was the first of its kind under the Personal Data Act, that would not render the interpretation and application by the domestic authorities arbitrary or unpredictable (see Kudrevičius, § 115, and Satakunnan Markkinapörssi Oy and Satamedia Oy, § 150, both cited above). Having regard to its limited jurisdiction as regards the interpretation of the domestic law by the national courts (see Anheuser-Busch Inc. v. Portugal [GC], no. 73049/01, § 83, ECHR 2007‑I) and the available material in its possession, the Court does not consider that the manner in which the Supreme Administrative Court interpreted the Personal Data Act was arbitrary and unreasonable.
88. In the light of the above, the Court concludes that the interference complained of was “prescribed by law” within the meaning of Article 9 § 2 of the Convention.
(iii) Legitimate aim
89. Taking into account the aims of the Personal Data Act (see paragraph 30 above) and the Data Protection Directive as interpreted by the CJEU (see paragraph 20 above, paragraph 35 of the CJEU’s judgment), as well as the established case-law of the Court (see paragraph 79 above), it is clear that the interference with the applicant community’s right to freedom of religion pursued the legitimate aim of protecting “the rights and freedoms of others”, data subjects in the present case, within the meaning of Article 9 § 2 of the Convention.
(iv) Necessary in a democratic society
90. The core question in the instant case is whether the interference with the applicant community’s right to freedom of religion (see paragraph 80 above) was “necessary in a democratic society” and whether, in answering this question, the domestic courts struck a fair balance between that right and the right to respect for private life of data subjects (see paragraph 63 above).
91. As indicated above, when exercising its supervisory function, the Court’s task is not to take the place of the national courts but rather to review, in the light of the case as a whole, whether the decisions they have taken pursuant to their power of appreciation are compatible with the provisions of the Convention relied on. Where the balancing exercise has been undertaken by the national authorities in conformity with the criteria laid down in the Court’s case-law, the Court would require strong reasons to substitute its view for that of the domestic courts (see, mutatis mutandis, Satakunnan Markkinapörssi Oy and Satamedia Oy, cited above, § 164).
92. Turning to the present case, the Court notes that the Personal Data Act aimed to ensure protection of the right to respect of private life, including the right to privacy of data subjects. The Act required that the collection and processing of personal and sensitive data meet certain requirements, in particular the unambiguous or express consent of data subjects. Those requirements had their origin in the Data Protection Directive, which has been transposed into the legislation of the EU member States and has thereby become applicable in those Council of Europe member States.
93. In the absence of any evidence and counter-arguments by the applicant community, the Supreme Administrative Court established that individual Jehovah’s Witnesses, at least in general, did not ask data subjects to consent expressly to the processing of personal data, nor did the applicant community instruct them to do so (see paragraph 28 above). The applicant community did not contest that finding. The court further held that the Board’s order prohibiting the applicant community from collecting and processing personal and sensitive data in the course of door‑to‑door preaching without the unambiguous consent of data subjects “[had] not [been] made ... in an attempt to hinder the religious practices of individual Jehovah’s Witnesses; rather, it [had been] made for reasons having to do with the processing of personal data”.
This was because “the right to privacy ... also belong[ed] to people whose personal data [was] being processed, and they [had] the right to expect that provisions regarding the processing of personal data be complied with” (see paragraph 29 above).
In finding that the “purely personal or household” exemption clause did not apply to the collection and processing of personal data by individual Jehovah’s Witnesses during their door-to-door preaching, the court noted that part of the personal data in question could be available from public sources, but considered this possibility immaterial for its conclusions. Accordingly, the court examined the matter by carrying out a balancing exercise between the privacy rights of data subjects and the applicant community’s right to freedom of religion.
94. The Court concurs with the Supreme Administrative Court that data subjects had a reasonable expectation of privacy with regard to personal and sensitive data being collected and processed in the course of door‑to‑door preaching. The fact that some personal data might be already in the public domain neither reduces this expectation nor does it mean that such data need less protection (see Satakunnan Markkinapörssi Oy and Satamedia Oy, cited above, § 134). This approach finds support in the relevant jurisprudence of the CJEU. In the case Satakunnan Markkinapörssi Oy and Satamedia Oy (C-73/07, EU:C:2008:727, 16 December 2008), the Grand Chamber of the CJEU held that “a general derogation from the application of the [Data Protection Directive] in respect of published information would largely deprive the directive of its effect” and that “[i]t would be sufficient for the Member States to publish data in order for those data to cease to enjoy the protection afforded by the directive” (see paragraph 48 of the judgment). This finding was confirmed and reinforced in the case Google Spain and Google (C‑131/12, EU:C:2014:317, judgment of 13 May 2014), in which the CJEU argued that “the operations referred to in Article 2(b) of Directive 95/46 [had to] also be classified as [data] processing where they exclusively concern[ed] material that [had] already been published in unaltered form in the media” (see paragraph 30 of that judgment).
95. The requirement of consent by the data subject is to be considered an appropriate and necessary safeguard with a view to preventing any communication or disclosure of personal and sensitive data inconsistent with the guarantees in Article 8 of the Convention in the context of door‑to‑door preaching by individual Jehovah’s Witnesses. In the absence of any convincing arguments by the applicant community, the Court cannot discern how simply asking for, and receiving, the data subject’s consent would hinder the essence of the applicant community’s freedom of religion. The applicant community failed to present any supporting evidence of the alleged “chilling effect” of the Board’s order, notwithstanding the lapse of time since the decision of the Supreme Administrative Court (see paragraphs 24 and 71 above).
96. It further notes that the Personal Data Act applied without distinction to all religious communities and religious activities.
97. Lastly, no fine, although requested (see paragraph 6 above), was imposed on the applicant community (see paragraph 11 above).
98. In the light of the aforementioned considerations, there are no strong reasons for the Court to substitute its view for that of the domestic courts and set aside the balancing done by them. It is satisfied that the reasons relied upon were both relevant and sufficient to show that the interference complained of was “necessary in a democratic society” and that the authorities of the respondent State acted within their margin of appreciation in striking a fair balance between the competing interests at stake.
99. There has accordingly been no violation of Article 9 of the Convention.
OTHER Alleged violations of the ConventionAlleged violation of Article 8 of the Convention100. The applicant community complained under Article 8 of the Convention that the Board’s order had violated the privacy rights of individual Jehovah’s Witnesses, because they had been “prohibited, on pain of a sanction and fine, from making notes containing their personal opinions and observations of conversations to which they were party”. In this connection, the applicant community submitted that a person’s name and address were data widely available in the public domain.
101. Article 8 of the Convention reads as follows:
“1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well‑being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
The parties’ submissions(a) The Government
102. The Government submitted that it was undisputed that the only applicant in the present application was the Jehovah’s Witnesses religious organisation, not any single individual Jehovah’s Witness. No extension could be made such that a church or ecclesiastical body could, on behalf of its adherents, exercise their rights guaranteed by Article 8 of the Convention. Furthermore, the applicant community could not be regarded as a direct victim of any alleged violation of Article 8. Accordingly, the applicant community lacked the victim status required by Article 34 of the Convention. Moreover, since the applicant community had not invoked Article 8 of the Convention or raised similar arguments in substance in its own name before the domestic courts, it had failed to exhaust the effective domestic remedies.
(b) The applicant community
103. The applicant community maintained that the Court had repeatedly held in its case-law that a church or ecclesiastical body could itself exercise on behalf of its adherents the rights guaranteed by Article 9 of the Convention (reference was made to Metropolitan Church of Bessarabia and Others v. Moldova, no. 45701/99, § 101, ECHR 2001-XII, and Association Les Témoins de Jéhovah v. France, no. 8916/05, § 51, 30 June 2011). By extension, this also applied to the privacy rights of individual adherents guaranteed by Article 8 of the Convention, particularly where those privacy rights were inextricably linked to the exercise of a religious belief or practice as in the present case (reference was made to Beizaras and Levickas v. Lithuania, no. 41288/15, §§ 78-81, 14 January 2020; Gorraiz Lizarraga and Others v. Spain, no. 62543/00, §§ 37-39, ECHR 2004-III; and Karastelev and Others v. Russia, no. 16435/10, §§ 72 and 75, 6 October 2020).
104. Moreover, it had “raised the privacy rights of individual Jehovah’s Witnesses” in the domestic proceedings. It had argued in its submissions to the Board, the Administrative Court and the CJEU that the practice of individual Jehovah’s Witnesses taking private notes of a shared religious conversation was inherently of a “personal” and “private nature”, thus raising the substance of Article 8 of the Convention. It had expressly relied on Article 8 of the Convention in its written material to the Supreme Administrative Court, which had addressed the issue in its decision of 17 December 2018 (paragraph 29 above).
The Court’s assessment105. According to the Court’s understanding of the applicant community’s complaint and its submissions (see paragraphs 100, 103 and 104 above), the allegations under this head concern only individual Jehovah’s Witnesses’ privacy rights under Article 8 of the Convention, which have been allegedly affected by the order prohibiting the collection and processing of personal data in the context of door-to-door preaching without the explicit consent of data subjects. Accordingly, the Court will confine its examination to the complaint as formulated by the applicant community.
106. The Court notes at the outset that the question of victim status, for the purposes of Article 34 of the Convention, is, in the instant case, closely linked to the requirement of exhaustion of domestic remedies contained in Article 35 § 1. For these reasons, it will outline some of the relevant general principles deriving from the Court’s case-law.
107. The Court points out that, in order to rely on Article 34 of the Convention, two conditions must be met: an applicant must fall into one of the categories of petitioners mentioned in Article 34, and he or she must be able to make out a case that he or she is the victim of a violation of the Convention. According to the Court’s established case-law, the concept of “victim” must be interpreted autonomously and irrespective of domestic concepts such as those concerning an interest or capacity to act. In addition, in order for an applicant to be able to claim to be a victim of a violation of the Convention, there must be a sufficiently direct link between the applicant and the harm which they consider they have sustained on account of the alleged violation (see, among other authorities, Tauira and Others v. France, no. 28204/95, Commission decision of 4 December 1995, Decisions and Reports (DR) 83-B, p. 112; Association des amis de Saint‑Raphaël et de Fréjus and Others v. France, no. 38192/97, Commission decision of 1 July 1998, DR 94-B, p. 124; and Comité des médecins à diplômes étrangers v. France and Others v. France (dec.), nos. 39527/98 and 39531/98, 30 March 1999, Yusufeli İlçesini Güzelleştirme Yaşatma Kültür Varlıklarını Koruma Derneği v. Turkey (dec.), no. 37857/14, §§ 37-39, 7 December 2021).
108. The general principles regarding the exhaustion rule under Article 35 § 1 of the Convention are set out in Vučković and Others v. Serbia ((preliminary objection) [GC] nos. 17153/11 and 29 others, §§ 70‑77, 25 March 2014).
109. The Court observes that the only applicant before it is the Jehovah’s Witnesses religious community, not any of its individual members (see, conversely, Beizaras and Levickas, § 80; and Gorraiz Lizarraga and Others, § 38; all cited above). Furthermore, the applicant community was the only party in the proceedings before the domestic authorities. The only attempt by two individual adherents to join the domestic proceedings was to no avail (see paragraph 12 above). The Administrative Court dismissed the appeal submitted by the individual members, holding that the Board’s order had not been addressed to them and could not be considered to have directly affected their rights, obligations or interests. These findings remained uncontested before the Supreme Administrative Court (see paragraph 13 above). The CJEU also unambiguously established that “the members of the Jehovah’s Witnesses Community whose collection of personal data [was] the basis for the questions referred [were] not parties to the main proceedings” (see paragraph 19 above, paragraph 32 of the CJEU’s judgment).
110. Furthermore, it is clear from the case file that until 20 September 2018 the applicant community did not raise in its submissions to the domestic authorities any Article 8 complaints, in form or in substance, and referred to Article 8 exclusively in the context of data subjects’ rights (see paragraphs 12 and 16 above). Its arguments that a person’s name and address were data widely available in the public domain and that therefore data subjects had “no reasonable expectation of privacy” were examined in the context of its complaint under Article 9 (see paragraph 94 above) and are of no importance for its grievances under this head.
111. It was only in its last written submissions to the Supreme Administrative Court of 20 September 2018, that is, more than five years after the proceedings had been instituted and subsequent to the preliminary ruling proceedings before the CJEU, that the applicant community argued, for the first time, that the Board’s order had violated individual Jehovah’s Witnesses’ right to privacy under Article 8 of the Convention. However, that complaint and the passing reference in reply by the Supreme Administrative Court (see paragraph 29 above) must be interpreted in the context of the scope of the case as defined by the Board (see paragraph 8 above) and the Supreme Administrative Court (see paragraphs 17 and 24 above), namely that it concerned only the applicant community and not its individual adherents (see, Yusufeli İlçesini Güzelleştirme Yaşatma Kültür Varlıklarını Koruma Derneği, cited above, §§ 42-44).
112. Accordingly, this complaint must be declared inadmissible as incompatible ratione personae with the provisions of the Convention and must also be rejected under Article 35 §§ 3 and 4 of the Convention for non‑exhaustion of domestic remedies.
Alleged violation of Article 14 and Article 1 of Protocol No. 12 to the Convention113. The applicant community complained of “religious discrimination” under Article 14, taken in conjunction with Articles 8, 9 and 10 of the Convention and under Article 1 of Protocol No. 12 to the Convention. It alleged that its religious activity had “received less favourable treatment” without “any objective and reasonable justification” in comparison with “journalism or artistic or literary expression”, as well as the Evangelical Lutheran Church and the Orthodox Church, which were exempted from penalties under the Data Protection Act.
114. Article 14 and Article 1 of Protocol No. 12 read as follows:
Article 14 (prohibition of discrimination)
“The enjoyment of the rights and freedoms set forth in [the] Convention shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status.”
Article 1 of Protocol No. 12 (General prohibition of discrimination)
“1. The enjoyment of any right set forth by law shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status.
2. No one shall be discriminated against by any public authority on any ground such as those mentioned in paragraph 1.”
The parties’ submissions(a) The Government
115. The Government argued that the applicant community had not invoked Article 14, read in conjunction with Articles 8 and 10, or Article 1 of Protocol No. 12 to the Convention or raised similar arguments in substance before the domestic courts. Furthermore, they submitted that it could not be considered a victim of any violation of Article 14, read in conjunction with Articles 8 and 10 and that, accordingly, its complaint was incompatible ratione materiae with the provisions of the Convention. The fact that it had raised, on a very technical level, allegations of discrimination on the grounds of religious activities in its last submissions to the Supreme Administrative Court, could not be deemed to be in line with the exhaustion requirement. The Government also submitted arguments about the merits of the complaint.
(b) The applicant community
116. The applicant community maintained that the complaint under this head had been raised at all stages of the domestic proceedings, and had been referred to and addressed by the Supreme Administrative Court in its decision of 17 December 2018. It further submitted arguments regarding the substance of its complaint under this head.
The Court’s assessment117. The Court considers that the applicant community’s complaint under this head must be examined in the context of the substantive scope of the case as defined by the domestic authorities, namely that it concerned the lawfulness of the processing of personal data in connection with the door‑to‑door preaching of individual Jehovah’s Witnesses (see paragraph 8 above). The domestic proceedings mainly concerned legal issues relating to the nature of the collection and processing of personal data of data subjects in the context of door-to-door preaching, and whether the applicant community could be regarded as a “controller” within the meaning of the Personal Data Act. They were instituted before the Board, as the competent body to decide those issues. The preliminary ruling proceedings before the CJEU were initiated in the same vein (see paragraph 17 above). Furthermore, and as noted above, the case concerned only the applicant community and not its individual members (see paragraph 108 above).
118. In the domestic proceedings, the applicant community did not raise any allegations of discrimination, either under Article 14 or Article 1 of Protocol No. 12, before the Board and the Administrative Court (see paragraphs 7 and 12 above). Allegations of discrimination were raised, for the first time and only in respect of individual Jehovah’s Witnesses, in its submissions to the Supreme Administrative Court on 20 April 2015 and 20 September 2018 (see paragraphs 16 and 18 above). It should be noted that the applicant community made no reference in those submissions to the “Evangelical Lutheran Church and the Orthodox Church” in respect of which it has alleged, for the first time before this Court, that it was treated differently without any objective and reasonable justification (see paragraph 113 above). The Court notes that the exemption of the said Churches from imposing an administrative fine was firstly introduced into Finnish law with the Data Protection Act that entered into force on 1 January 2019 after the proceedings before the Supreme Administrative Court had been completed (see paragraph 37 above). Accordingly, it cannot be accepted that the statement of the Supreme Administrative Court that “[t]he [Board’s] decision [would] not subject the Community or individual Jehovah’s Witnesses to different treatment in comparison with other religious communities or their members” concerned the applicant community’s allegations regarding the said Churches (see paragraph 29 above).
119. Furthermore, the Supreme Administrative Court’s statement that “the [Board’s] decision ... [did] not violate the provisions and regulations on the prohibition of discrimination” was general in nature and did not follow any examination by the lower authorities, which, as noted above, were not invited to pronounce themselves, and consequently, were divested of the opportunity to put right the alleged violation. Such a succinct statement must also be seen in the context of the substantive scope of the case before the domestic authorities (see paragraph 117 above).
120. In such circumstances, the Court considers that the applicant community did not adequately raise its allegations under this head before the domestic authorities. Accordingly, the complaint under this head must be rejected under Article 35 §§ 1 and 4 of the Convention for non‑exhaustion of domestic remedies. Given this conclusion, it is not necessary for the Court to separately examine the Government’s objection of incompatibility ratione materiae (see paragraph 115 above).
FOR THESE REASONS, THE COURT, UNANIMOUSLY,
Declares the complaints under Articles 6 and 9 of the Convention admissible and the remainder of the application inadmissible;Holds that there has been no violation of Article 6 of the Convention on account of the lack of an oral hearing;Holds that there has been no violation of Article 9 of the Convention on account of the incompatibility of the applicant community’s religious activities with the data protection regulations.Done in English, and notified in writing on 9 May 2023, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Hasan Bakırcı Arnfinn Bårdsen
Registrar President