法律翻译｜Bodil Lindqvist案件：何为《95指令》的适用范围？

译者｜巩海璐 华东政法大学 硕士

一审｜曾梓栩 外交学院 法本

二审｜何兰子夜 宾夕法尼亚大学 ML

编辑｜杨玟萱 中南财经政法大学本科

         李建云 湖南师范大学本科

责编｜戚琳颖 大连海事大学本科

Bodil Lindqvist案件：

何为《95指令》的适用范围？

This case was referred by the Court of Appeal Gota (Sweden) to the ECJ for a preliminary ruling on questions concerning the interpretation of the Data Protection Directive. The questions arose from criminal proceedings against Mrs. Lindqvist who was charged with the breach of Swedish legislation on Protection of Personal Data (Personuppgiftslagen, PUL).

Mrs. Lindqvist was a maintenance worker and a catechist in the parish of Alseda (Sweden). In 1998, she had set up internet pages on her personal computer with personal data of number of people working for her on a voluntary basis in the parish so that parishioners preparing for their confirmation could obtain the information that they required. At her request, the administrator of the Swedish Church's website set up a link between the pages containing the information and the website.

The pages contained information about eighteen people, apart from Mrs. Lidqvist, including their telephone numbers, job description, hobbies, family circumstances, and on one instance-description of medical conditions. The pages in question were made without the knowledge or consent of her colleagues and without informing the supervisory authority for the protection of electronically transmitted data. Mrs. Lidqvist removed the pages in question as soon as she became aware that they were not appreciated by some of her colleagues.

（图片来源于网络）

Subsequently, the public prosecutor charged Mrs. Lindqvist with breach of the PUL for processing personal data by automatic means, without giving prior written notification to the Datainspektionen (“Supervisory Authority”), for processing sensitive personal data and for transferring processed personal data to a third country without authorization. While Mrs. Lindqvst agreed to the facts, she disputed the offense. She was found guilty by the Eksjö tingsrätt (District Court) and fined. The case was then appealed to the Court of Appeal of Gota (Sweden). As the Court of Appeal had doubts as to the interpretation of the applicable Community law, including scope and interpretation of the Data Protection Directive, it decided to stay the proceedings and refer 7 questions to the ECJ for a preliminary ruling.

A. Whether mentioning a name and telephone number on an internet homepage constituted an action within the scope of the Data Protection Directive and more specifically if it was the “processing of personal data wholly or partly by automatic means”.

B. Whether the act of setting up on an internet homepage, separate pages for about 15 people with links between them to enable search by first name be considered “processing otherwise than by automatic means of personal data which form part of a filing system [2] or are intended to form part of a filing system” within the meaning of Article 3(1) [3] of the Data Protection Directive.

C. Whether the act of loading information, accessible to anyone who knew its address, was outside the scope of the Data Protection Directive as an exception in accordance with Article 3(2) [4].

D. Whether information on a home page stating that a named colleague had injured her foot and was on half-time on medical grounds, constituted personal data concerning health, which according to Article 8(1) [5] of the Data Protection Directive, may not be processed.

E. Whether the said act constituted transmission of data against the Data Protection Directive if someone from a third country accessed it.

F. Whether provisions of the Data Protection Directive constituted a restriction which conflicted with the general principles of freedom of expression or other freedoms and rights under Article 10 [6] of the European Convention on the Protection of Human Rights and Fundamental Freedoms (ECHR).

G. Whether a Member State, as regards the issues raised in the above questions, could provide more extensive protection for personal data or give it a wider scope than the Data Protection Directive, even if none of the circumstances described in Article 13 [7]  existed.

（图片来源于网络）

The Court held that the act of referring names or telephone numbers or information regarding working conditions and hobbies of a person, on an internet page constituted the ‘processing of personal data wholly or partly by automatic means’ under Article 3(1) of the Data Protection Directive. The Court relied upon the definition of ‘personal data’ under Article 2(a) [8] which included ‘any information relating to an identified or identifiable natural person’. While examining the meaning of ‘wholly or partly by automatic means’, the Court held that placing information on an internet page by technical procedures entailed loading that page onto a server, and operations necessary to make the page accessible over the internet, which was at least in part automatic. Since the first question was answered in the affirmative, the Court did not dwell into the second question, relating to setting up individual pages for the members which could be searched by the first name of the individuals.

In relation to the third issue on exceptions under Article 3(2) of the Directive, the Court held that the acts of Mrs. Lindqvist were not commercial but charitable and religious. The first exception under Article 3(2) excluded activities such as those provided for by Titles V and VI of the Treaty on European Union, and processing operations concerning public security, defense, State security and the activities of the State in areas of criminal law. By applying ejusdem generis the Court stated that scope of the exception provided within Article 3(2) applied only to the activities which were expressly listed in the Article or which could be classified in the same category of such activities. Charitable or religious activities, such as those undertaken by Mrs. Lindqvist could not be considered equivalent to the activities listed and thus were not covered by the exception. As regards to the exception provided for in the 12th [9] recital to the preamble of the Data Protection Directive, relating to processing for home or domestic correspondence, the Court held that the exception applied only for processing of personal data and certainly not to processing data consisting of a publication on the internet to make it accessible to an indefinite number of people.

（图片来源于网络）

The Court held that the expression ‘data concerning health’ in Article 8(1) of the Data Protection Directive must be given a broad interpretation so as to include information concerning all aspects, both physical and mental health of an individual. Thus, reference to the fact that an individual had injured her foot, and was subsequently on half-time on medical grounds would constitute personal data concerning health within the meaning of Article 8 (1) of the Data Protection Directive. The Court examined the purpose and structure of Chapter IV of the Data Protection Directive, to determine whether the accessibility of a page from a third country would amount to transfer under Article 25 [10]. Here, the Court observed that the personal data appearing on the computer of a person in a third country, was not directly transferred by the person who had loaded them on an internet site, but was transferred between those two people through the computer infrastructure of the hosting provider [11] where the page was being stored. Computers which constituted the infrastructure with the necessary data, could be located, in one or more countries other than that where the hosting provider is established, without its clients being aware or being in a position to be aware of it.

The Court held that if Article 25 of the Data Protection Directive was interpreted to mean that there is “transfer [of data] to a third country” every time that personal data were loaded onto an internet page, that transfer would necessarily constitute a transfer to all the third countries which had technical means needed to access the internet making Chapter IV a regime which would have to be generally applied. Therefore, the Court held that the acts by Mrs. Lindqvist did not constitute transfer of data under Article 25.

Relying on the 3rd [12] and 7th recital [13] to the preamble of the Data Protection Directive, the Court stated that while there could be differences in various national rules establishing the processing of data they must be harmonized to ensure free flow of data with adequate protection to fundamental rights. The Court observed that while the provisions of theData Protection Directive were relatively general, the rules included a degree of flexibility. While the Member States had a certain margin of manoeuvre in implementing the Data Protection Directive, the Directive itself was still predictable and harmonious to the general principles of Community law and fundamental rights protected by the Community legal order. Consequently, the authorities and courts of the Member States would have to interpret their national law in a manner consistent with theData Protection Directive and the fundamental rights protected by the Community. Therefore, the Court held that it was for the referring court to take account, according to the principle of proportionality [14], of all the circumstances of the case before it, to ensure a fair balance between the rights and interests in question, including the fundamental rights protected by the Community legal order.

Recitals 8 [15] and 10 [16] of the preamble to the Data Protection Directive seek to ensure the level of protection accorded in all Member States to be equal and that the national law ensuring such harmonization was to ensure a high level of protection in the Community. Therefore, the Court stated that the harmonisation of national laws was not limited to minimal harmonisation but to harmonisation which was generally complete. The Court further observed that although the Data Protection Directive allowed a margin of manoeuvre in certain areas, they were to be in accordance with its objective of maintaining a balance between the free movement of personal data and the protection of private life. It further held that the Member States were allowed to implement the provisions of the Data Protection Directive and expand it so long as Community law did not preclude the same.

ECJ Case C-101/01 has important implications for the posting of personal data on the Internet. Through this case, the court has clarified that posting personal data on the Internet amounts to processing personal data for the purposes of the Data Protection Directive. The court's finding highlights the fact that Europe's data protection regime is extremely far reaching.

（图片来源于网络）

The enforcement action that was launched against Lindqvist, and validated in large part, by the ECJ, is not likely to be the last of its kind. In fact, Norway's data protection authorities recently announced that they would be pursuing web site operators that display photos that were taken of individuals without their prior consent. Accordingly, the activity of the local data protection authorities, along with the ECJ's decision should serve as a wake-up call to all entities and individuals that process personal data in Europe and/or about Europeans, including by posting such data on an Internet website [17].

判决书链接：

https://curia.europa.eu/juris/showPdf.jsf;jsessionid=460406347051870D2140CBFB0BE89687?text=&docid=48382&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=24181728

原文链接：

https://privacylibrary.ccgnlud.org/case/bodil-lindqvist