EHRM, 27-06-2017, nr. 931/13

On an unspecified date, probably in 2003, the Data Protection Ombudsman (tietosuojavaltuutettu, dataombudsmannen) contacted the applicant companies and advised them that, although accessing and publishing taxation data were not prohibited as such, they had to cease publishing such data in the manner and to the extent that had been the case in 2002, when they had published data concerning the 2001 tax year. The applicant companies refused to abide by this request, which they considered violated their right to freedom of expression.

By a letter of 10 April 2003 the Data Protection Ombudsman asked the Data Protection Board (tietosuojalautakunta, datasekretessnämnden) to prohibit the applicant companies from processing the taxation data in the manner and to the extent that had been the case in 2002 and from passing those data to the SMS service. He claimed that under the Personal Data Act the companies had no right to collect, store or pass on personal data and that the derogation provided by that Act concerning journalism did not, in his view, apply to the present case. The collecting of taxation information and the passing of such information to third parties were not for journalistic purposes and therefore were not covered by the derogation in the Personal Data Act, but rather constituted the processing of personal data in which the applicant companies had no right to engage.

On 7 January 2004 the Data Protection Board dismissed the Data Protection Ombudsman's request. It found that the derogation laid down in the Personal Data Act concerning journalism applied to the present case. As regards the SMS service, the data used in the service had already been published in Veropörssi and therefore the Act did not apply to it.

By letter dated 12 February 2004 the Data Protection Ombudsman appealed to the Helsinki Administrative Court (hallinto-oikeus, förvaltningsdomstolen) reiterating his request that the applicant companies be prohibited from processing taxation data in the manner and to the extent that had been the case in 2002 and from passing such data to the SMS service.

On 29 September 2005 the Administrative Court rejected the appeal. It found that the derogation laid down in the Personal Data Act concerning journalism, which had its origins in Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data was adopted (OJ 1995 L 281, p. 31, hereafter ‘the Data Protection Directive’), should not be interpreted too strictly, as an overly strict interpretation would favour protection of privacy over freedom of expression. That court considered that Veropörssi had a journalistic purpose and that it was also in the public interest to publish such data. It emphasised, in particular, that the published data were already accessible to the general public. The journalism derogation thus applied in the circumstances of the present case. As regards the SMS service, the Administrative Court agreed with the Data Protection Board that, as the information had already been published in the newspaper, the Act did not apply to it.

By letter dated 26 October 2005 the Data Protection Ombudsman lodged an appeal with the Supreme Administrative Court (korkein hallinto-oikeus, högsta förvaltningsdomstolen), reiterating the grounds of appeal already presented before the Helsinki Administrative Court.

On 8 February 2007 the Supreme Administrative Court decided to request a preliminary ruling from the Court of Justice of the European Communities (which became the Court of Justice of the European Union on 1 December 2009, hereafter the ‘CJEU’) on the interpretation of Directive 95/46/EC.

On 16 December 2008 the Grand Chamber of the CJEU handed down its judgment (see Case C-73/07 Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy and Satamedia Oy, EU:C:2008:727). It found, first of all, that the activities in question constituted ‘processing of personal data’ within the meaning of Article 3(1) of Directive 95/46. According to the CJEU, activities involving the processing of personal data such as those relating to personal data files which contained solely, and in unaltered form, material that had already been published in the media, also fell within the scope of the Directive (see paragraphs 37 and 49 of the judgment). The object of the derogation in Article 9 of the Directive for the processing of personal data carried out solely for journalistic purposes was to reconcile the protection of privacy with freedom of expression. In order to take account of the importance of the latter in every democratic society, it was necessary to interpret notions relating to that freedom, such as journalism, broadly. However, in order to achieve a balance between those two fundamental rights, the protection of the fundamental right to privacy required that the derogations and limitations in relation to the protection of data had to apply only in so far as were strictly necessary (see paragraphs 54 and 56 of the judgment). Journalistic activities were not limited to media undertakings and could be undertaken for profit-making purposes (see paragraph 61). Furthermore, when interpreting the journalistic purposes derogation, account must be taken of the evolution and proliferation of methods of communication and the dissemination of information. Activities such as those involved in the domestic proceedings, relating to data from documents which were in the public domain under domestic legislation, could be classified as ‘journalistic activities’ if their sole object was the disclosure to the public of information, opinions or ideas, irrespective of the medium which was used to transmit them. Whether or not that was the case, was for the national court to determine (see paragraphs 60–62 of the judgment).

On 23 September 2009 the Supreme Administrative Court, applying the ruling of the CJEU and with reference to the case-law on Article 10 of the Convention, quashed the impugned decisions of the Data Protection Board and the Helsinki Administrative Court and referred the case back to the Data Protection Board for a fresh examination with a view to issuing an order pursuant to section 44(1) of the Personal Data Act. The Supreme Administrative Court requested the Board to prohibit the processing of taxation data by the applicant companies in the manner and to the extent carried out in 2002.

In its legal assessment, the Supreme Administrative Court gave the following reasoning:

The relevant provisions of the Personal Data Act (henkilötietolaki, personsuppgiftslagen, Act no. 523/1999, as in force at the relevant time) provided:

Following the judgment of the CJEU of 2008 in the present case (see Satakunnan Markkinapörssi Oy and Satamedia Oy, cited above), section 2(4) of the Personal Data Act was repealed by an Act enacted on 3 December 2010.

Government Bill to Parliament HE 96/1998 vp provides background information regarding the journalistic purposes derogation in section 2(5) of the Personal Data Act. The definition of a database for journalistic purposes was derived from the previous Act but was modified in order to transpose the Data Protection Directive. According to the preparatory work, ‘a database for journalistic purposes means such databases as are intended to be used only in the context of the journalistic activity of the media and which are not accessible to others’. ‘Media’ is taken to mean any kind of mass media, including news and photo agencies when they keep databases containing personal data used in media's publishing activities or a news agency's own publishing activities. Information collected for storage in a database for journalistic purposes can be used only in the context of a journalistic activity, and not, for example, for administrative or marketing purposes. It is also required that the circle of users of the database is limited such as to be accessible only to those persons involved in the journalistic activity. A database for journalistic purposes can be kept, for example, by a newspaper publisher, an individual journalist or a free-lance journalist.

In a decision of 23 January 2015, the Helsinki Administrative Court held that public taxation data could be provided to media in mass deliveries in electronic format. However, neither freedom of expression as a fundamental right nor the preparatory work relating to legislation on the publicity of and access to taxation data supported an interpretation of the law to the effect that the applicant in that case — a representative of a media organisation which had requested data relating to 5.2 million persons (all natural persons earning more than 1 euro in Finland) — had the right to receive such data in electronic format for journalistic purposes.

In contrast, in his opinion of 5 July 2013, addressed to a complainant on another matter, the Data Protection Ombudsman held that the media organisation in question (Helsingin Sanomat) had processed data for journalistic purposes within the meaning and scope of the section 2(5) derogation. The latter had not published all of the personal data files collected by it for journalistic purposes, but had published data on a limited group of 10,000 persons considered to be the wealthiest people in Finland. The data published were accompanied by articles and presentations on some of those featured.

Article 8, paragraphs 1 and 2, of the Charter provides:

Article 11 of the Charter reads as follows:

Article 52, paragraph 3, of the Charter provides that, in so far as the Charter contains rights which correspond to rights guaranteed by the Convention, the meaning and scope of those rights shall be the same as those laid down by the Convention. This provision of the Charter does not prevent EU law from providing more extensive protection.

According to the explanations relating to the Charter, Article 8 is based, inter alia, on Article 8 of the Convention and on the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data (hereafter the ‘Data Protection Convention’), which has been ratified by all EU Member States. Similarly, Article 11 of the Charter is said to correspond to Article 10 of the Convention.

According to Article 1(1) of the Directive, its objective is to protect the fundamental rights and freedoms of natural persons, and, in particular, their right to privacy with respect to the processing of personal data. In accordance with recital 11 of the Directive, the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in the Directive, give substance to and amplify those contained in the aforementioned Data Protection Convention.

Personal data are defined in Article 2 (a) as any information relating to an identified or identifiable person. The processing of personal data is defined as ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction’ (see Article 2(b)). A ‘controller’ for the purposes of the Directive is a natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data (see Article 2(d)), whereas a ‘processor’ is a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller (see Article 2(e)).

According to Article 3(1), the Directive applies to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

It is for the member States, within the limits of Chapter II of the Directive, to determine more precisely the conditions under which the processing of personal data is lawful (see Article 5). In this regard, the Directive provides, inter alia, that the data subject must have unambiguously given his consent or that the processing must be necessary for the performance of a task carried out in the public interest or that the processing must be necessary for the purposes of the legitimate interests pursued by the controller. Derogations from these provisions are provided in well-defined circumstances (see Article 7).

Article 9 of the Directive, entitled ‘Processing of personal data and freedom of expression’, provides:

In that connection, recital 37 of the Directive is worded as follows:

Pursuant to Article 28(1) and (3) of the Directive, each member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the member States pursuant to the Directive. Each authority so established shall be endowed with the power to engage in legal proceedings where the national provisions adopted pursuant to the Directive have been violated or to bring these violations to the attention of judicial authorities. Decisions by the supervisory authority which give rise to complaints may be appealed against through the Courts.

Articles 22 and 23 of the Data Protection Directive provide, respectively, for the right to a judicial remedy for persons whose rights under national law on processing have been breached and the right to compensation for any person who has suffered damage as a result of an unlawful processing operation or act incompatible with national provisions adopted pursuant to the Directive.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119/1) entered into force on 24 May 2016. It will repeal Directive 95/46/EC as of 25 May 2018 (see Article 99).

Recitals 4, 6, 9 and 153 of the new Regulation provide as follows:

Article 85 of the Regulation, which will replace the journalistic purposes derogation in Article 9 of the Directive, provides as follows:

The CJEU has repeatedly held that the provisions of the Data Protection Directive, inasmuch as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to respect for private life, must necessarily be interpreted in the light of the fundamental rights guaranteed by the Convention and the Charter (see variously Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, judgment of 20 May 2003, paragraph 68; Google Spain and Google, C‑131/12, EU:C:2014:317, judgment of 13 May 2014, paragraph 68; and Ryneš, C‑212/13, EU:C:2014:2428, judgment of 11 December 2014, paragraph 29).

Given the relevance of Directive 95/46 to the balancing of the fundamental rights to privacy and freedom of expression at issue before the Finnish competent authorities and domestic courts in the instant case, the data protection case-law of the CJEU is set out in some detail.

At issue in Österreichischer Rundfunk, cited above, was national legislation which required a State control body, the Court of Audit, to collect and communicate, for purposes of publication, data on the income of persons employed by the bodies subject to its control, where that income exceeds a certain threshold. The purpose of the collection and publication of the information was to exert pressure on public bodies to keep salaries within reasonable limits. The CJEU held that, while the mere recording by an employer of data by name relating to the remuneration paid to his employees cannot as such constitute an interference with private life, the communication of that data to third parties, in the present case a public authority, infringes the right of the persons concerned to respect for private life, whatever the subsequent use of the information thus communicated, and constitutes an interference within the meaning of Article 8 of the Convention. Citing Amann v. Switzerland [GC], no. 27798/95, § 70, ECHR 2000-II, it also held that to establish the existence of such an interference, it did not matter whether the information communicated was of a sensitive character or whether the persons concerned had been inconvenienced in any way (paragraphs 74–75). Finally, the CJEU held that the interference resulting from the application of the Austrian legislation may be justified under Article 8(2) of the Convention only in so far as the wide disclosure not merely of the amounts of the annual income above a certain threshold of persons employed by the bodies subject to control by the Court of Audit but also of the names of the recipients of that income was both necessary for and appropriate to the aim of keeping salaries within reasonable limits, that being a matter for the national courts to examine (paragraph 90). It emphasised, as regards the proportionality of the interference and the seriousness of the latter, that it was not impossible that the persons affected might suffer harm as a result of the negative effects of the publicity attached to their income from employment (paragraph 89).

In Lindqvist (judgment of 6 November 2003, C-101/01, EU:C:2003:596) the CJEU held that the act of referring, on an Internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constituted the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of the Data Protection Directive. Noting that the directive seeks to ensure not only the free flow of such data between Member States but also the safeguarding of the fundamental rights of individuals and that those objectives may be inconsistent with one another, the CJEU held that the mechanisms allowing those different rights and interests to be balanced are contained, first, in the Directive itself, and, second, result from the adoption, by the Member States, of national provisions implementing that directive and their application by the national authorities (paragraphs 79–82). The provisions of the Directive do not, in themselves, bring about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights which are applicable within the EU and are enshrined inter alia in Article 10 of the Convention. It is, according to the CJEU, for the national authorities and courts responsible for applying the national legislation implementing the Directive to ensure a fair balance between the rights and interests in question, including the fundamental rights protected by the EU legal order (paragraphs 83–90).

In Volker und Markus Schecke GbR (judgment of 9 November 2010, C-92/09 and C-93/09, EU:C:2010:662), the CJEU held that the obligation imposed by EU regulations to publish on a website data relating to the beneficiaries of aid from EU agricultural and rural development funds, including their names and the income received, constituted an unjustified interference with the fundamental right to the protection of personal data. Referring to Amann, cited above, and Rotaru v. Romania [GC], no. 28341/95, ECHR 2000-V, it pointed out that the professional nature of the activities to which the data referred did not imply the absence of a right to privacy. The fact that the beneficiaries of aid had been informed that the data might be made public was not sufficient to establish that they had given their consent to its publication. As regards the proportionality of the interference with privacy rights, the CJEU held that it did not appear that the EU institutions had properly balanced the public interest objective in the transparent use of public funds against the rights which natural persons are recognised as having under Articles 7 and 8 of the Charter. Regard being had to the fact that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary, and that it was possible to envisage measures which would have affected less adversely that fundamental right of natural persons and which would still have contributed effectively to the objectives of the European Union rules in question, the CJEU held that the EU regulations in question exceeded the limits which compliance with the principle of proportionality imposes and struck them down.

In Google Spain, cited above, the CJEU held that the operations carried out by the operator of an internet search engine must be classified as ‘processing’ within the meaning of the Data Protection Directive regardless of the fact that the data have already been published on the internet and are not altered by the search engine. Inasmuch as the activity of a search engine is liable to affect significantly fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure that the activity meets the requirements of the Directive in order that the guarantees laid down by the Directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved. As regards the derogation in Article 9 of the Directive, while the CJEU did not exclude that processing by the publisher of a web page may, in some circumstances, be carried out ‘solely for journalistic purposes’ and thus benefit from that derogation, the same did not appear to be the case as regards processing carried out by the operator of a search engine. The CJEU also held that the processing of personal data may be incompatible with the Directive not only because the data are inaccurate but, in particular, also because ‘they are inadequate, irrelevant or excessive in relation to the purposes of the processing, that they are not kept up to date, or that they are kept for longer than is necessary unless they are required to be kept for historical, statistical or scientific purposes’ (paragraph 92).

In Schrems (judgment of 6 October 2015 (Grand Chamber), C-362/14, EU:C:2015:650, paragraphs 41–42), the CJEU held that national supervisory authorities must, in particular, ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data. According to the CJEU, legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter (paragraph 95).

More recently, in Tele2 Sverige (judgment of 21 December 2016, C-203/15, EU:C:2016:970), where it had to interpret an EU regulation concerning the processing of personal data and the protection of privacy in the electronic communications sector, whose provisions particularise and complement Directive 95/46 (paragraph 82), the CJEU held, at paragraph 93:

In Connolly v. Commission (judgment of 6 March 2001, C-274/99 P, EU:C:2001:127), a case involving the right to freedom of expression of an EU official and the limitations placed thereon, the CJEU held, at paragraphs 37–42:

In Philip Morris (judgment of 4 May 2016, C-547/14, EU:C:2016:325, paragraph 147), the CJEU confirmed the correlation between Article 10 of the Convention and Article 11 of the Charter:

Within the framework of the Council of Europe, the Data Protection Convention formulates a number of core principles for the collection and processing of personal data. The purpose of the Convention is, according to Article 1, to secure respect for every individual's rights and fundamental freedoms, and in particular his right to privacy, with regard to the automatic processing of personal data relating to him. The Convention includes the following basic principles:

[…]

The Data Protection Convention is currently being updated.

From the information available to the Court, it would appear that, apart from Finland, only Iceland, Italy, France, Monaco, Sweden and Switzerland provide for some form of public accessibility of individual taxation information.

In contrast, of the 40 Council of Europe States surveyed, 34 provide, in principle, for the secrecy of personal taxation information. Such data can only be disclosed either with the consent of the person concerned or where disclosure is provided for by law. Exceptions to the secrecy rule exist also for certain types of taxation data (tax debts and exemptions, public registers for business activity) and for data concerning the tax affairs of public officials.

The applicant companies maintained that the domestic decisions had prevented them from imparting information and had as a consequence impeded them ‘entirely’ from carrying out their publishing activities. The said interference had taken the form of a prior ban. On 1 November every year, when the tax records of the previous year became public, numerous newspapers and other media published personal tax data in paper and electronic formats. This was no different from what the applicant companies had engaged in, apart from the quantity of the published data. The majority of the persons whose data were accessible in this way were not known to the public and were of varying backgrounds and professions. No particular judicial attention had ever been paid to the identity of the persons whose names and amounts of taxable income had been published. Nor had the activities of other media ever been subject to the Data Protection Ombudsman's scrutiny.

The applicant companies argued that this interference with their right to freedom of expression had not been ‘prescribed by law’. The publishing of taxation data had, in particular, been accepted by the Finnish legislator. The preparatory work relating to the Act on the Public Disclosure and Confidentiality of Tax Information noted that such publishing had taken place for years and also served certain societal purposes. A thorough discussion had taken place during the preparation of the said Act, assessing the pros and cons of publishing taxation data, and the legislator had finally decided to maintain public access to such data. The Personal Data Act was not intended to restrict publishing activities. The relevant preparatory work stated that the legal status of the data in question was to remain unchanged. The journalistic purposes derogation was to apply to databases that were designed to support publishing so as to prevent even indirect prior restrictions on freedom of expression. Possible violations of privacy were to be examined and dealt with ex post facto. On this basis the applicant companies argued that the interference had not been ‘prescribed by law’ within the meaning of Article 10 § 2 of the Convention.

The applicant companies also claimed that the interference had not been ‘necessary in a democratic society’. There had never been any issue as regards the accuracy of the information, only its quantity. The balancing criteria applied by the Court functioned best where the privacy of one or two persons was concerned. In such situations the data relating to a particular individual took prominence. When hundreds of thousands of names were published, all in the same manner, the information concerning a specific person ‘blended in’. The publication of such data could hardly violate anyone's privacy. For such situations, a different type of balancing criteria ought to be applied in order to better take into account the nature of the mass data published, namely a criterion for protecting the privacy of a large population. Moreover, when other media had published taxation data on, for example, 150,000 individuals, it had never been requested that this information be viewed in the light of the Court's balancing criteria. It was only when the applicant companies had published 1.2 million names that such criteria became applicable.

The issue of public interest had been examined when the Act on the Public Disclosure and Confidentiality of Tax Information was enacted. According to the applicant companies, public access to tax data enabled the public to observe the results of tax policies and how differences in income and wealth developed, for example, between different regions, occupations and sexes. It also enabled supervision by the Finnish tax administration as people reported their suspicions of tax evasion directly to the tax administration. In 2015 alone, the tax administration had received 15,000 such reports. The applicant companies thus argued that a balance between the public and publishable tax records, on the one hand, and the protection of privacy, on the other hand, had already been struck by the Finnish legislator. Therefore, no margin of appreciation, or at least a very narrow one, was left to the domestic authorities. There was thus no need for any re-balancing. Contrary to Fressoz and Roire v. France [GC], no. 29183/95, ECHR 1999-I, the taxation information in the present case had been obtained lawfully by the applicant companies from public tax records, in the same manner as any other member of the public. The effect on a person's privacy could not in any significant way be different depending on whether the information had been received from the applicant companies, other media or through a phone-in service operated by the tax administration itself. Since the information had been so readily available, its publication could not violate anyone's privacy.

Referring to the definition of journalistic activities set out in the draft EU General Data Protection Regulation, the applicant companies argued that their publishing activities should be considered as journalism. The reasoning of the Supreme Administrative Court was in contradiction with this definition, which fact was bound to endanger the very idea of freedom of expression. Given the terms of the Supreme Administrative Court's judgment, one had to ask how much information needed to be published to transgress the limit between publishable and non-publishable information. The quantity and the manner in which taxation information could be lawfully published had, according to the applicant companies, never been defined. The national court had failed to take into account the balancing criteria in the Court's case-law, and had only had regard to the public interest criterion. There should in any event be no upper limit on the quantity of information publishable.

The Government agreed, in essence, with the Chamber's finding of no violation, but contended that there had been no interference with the applicant companies' right to impart information. The applicant companies could still collect and publish public taxation data in so far as they complied with the requirements of data protection legislation.

In the event that the Court were to find that an interference had occurred, the Government agreed with the Chamber's finding that the interference was prescribed by law and pursued the legitimate aim of protecting the reputation or rights of others. As to the further question whether any interference had been necessary in a democratic society, the Government shared the Chamber's view that the general subject-matter, namely taxation data relating to natural persons' taxable income, was a matter of public interest. Taxation data were publicly available in Finland but had to be accessed and used in conformity with the Personal Data Act and the Act on the Openness of Government Activities. Public access to such information did not imply that that information could always be published. Respect for personal data and privacy under Article 8 of the Convention required the disclosure of such information to be subject to certain controls.

The Government emphasised that the applicant companies had requested the data in question from the National Board of Taxation in 2000 and 2001. On the basis of an opinion received by the Board from the Data Protection Ombudsman, the Board had requested the applicant companies to provide further information regarding their request, and indicated that the data could not be disclosed if the publishing methods of Veropörssi continued unchanged. The applicant companies had then cancelled their request while explaining that they would provide information to the Data Protection Ombudsman and the National Board of Taxation the following year, which they never did. Instead, they employed people to collect taxation data manually at the local tax offices.

The Government pointed out that, according to the Guidelines for Journalists which were in force at the material time, the right to privacy also applied when publishing public documents or other information originating from public sources. The Guidelines made clear that the public availability of information did not necessarily imply that it could be freely published.

The Government noted that, as the domestic courts had made clear, the manner and extent of the publication were of importance. The data published in Veropörssi had encompassed data relating to 1.2 million persons, almost one third of all taxpayers in Finland. Other Finnish media published taxation data concerning 50,000 to 100,000 individuals annually, which was considerably less than the applicant companies. The latter published, without any analysis, data on persons with low or medium income who were not public figures and held no important positions in society. Their publishing activities could not therefore be viewed as data journalism aimed at drawing conclusions from such data and drawing attention to issues of public interest for public debate. Such publishing did not contribute to public debate in a manner that outweighed the public interest in protecting the processing of personal data to the described extent; it mainly satisfied readers' curiosity. The applicant companies had not been prevented from publishing taxation data as such or participating in any public debate on an issue of general importance.

Should the public interest in ensuring the transparency of the taxation data require the possibility of their disclosure by, for instance, publishing the data by the media, the Government took the view that that aim could have been accomplished without processing personal data to the extent prohibited by the Personal Data Act and the Data Protection Directive. The present case differed from Fressoz and Roire v. France, cited above, in which the publishing of data concerned a single person having a key role in a public debate on a socially important issue. Contrary to the applicant companies' allegations, the present case was not abstract and hypothetical. Private persons had been affected by their activities: between 2000 and 2010 the Data Protection Ombudsman had received a number of complaints requesting his intervention. There was thus a pressing social need to protect private life under Article 8 of the Convention.

Concerning the interpretation of the Data Protection Directive, the CJEU had noted in its preliminary ruling in the present case that it was necessary to interpret the notion of journalism broadly and that derogations and limitations in relation to data protection had to apply only insofar as was strictly necessary. The applicant companies were never prevented from publishing taxation information in general. They could have, had they so wished, adjusted their activities so as to comply with the Personal Data Act.

Referring to the margin of appreciation, the Government emphasised, as did the Chamber, that the Court would need strong reasons to substitute its own view for that of the domestic courts. The domestic courts had been acting within the margin of appreciation afforded to them and had struck a fair balance between the competing interests at stake. The interference complained of was ‘necessary in a democratic society’ and there had been no violation of Article 10 of the Convention.

The European Information Society Institute noted that data journalism involved the making of already existing information more useful to the public. Processing and analysing of available data on a particular topic was also an important journalistic activity in and of itself. To remove the protection of Article 10 when journalists published databases would jeopardise the protection that ought to be afforded to a wide range of activities in which journalists engaged to impart information to the public. If the use of new technologies could not find protection under Article 10, the right to impart information as well as the right to receive it would be seriously impaired.

The traditional criteria for defining the limits on the quantity of information that could be published and processed by private actors were not well suited to balancing the tensions created by data journalism. The balancing factors previously used by the Court were not useful in cases like the present one. When data journalists made available information that was in the public interest, their actions should be supported in a democratic society — not silenced. The European Information Society Institute therefore suggested that the Court might revisit its method of applying the existing case-law in cases where journalists processed information in order to impart information to the public. It should extend the Article 10 protection to innovative forms of journalism and recognise that the standard for determining how Article 10 protected journalists engaged in the processing of data could have important consequences.

NORDPLUS Law and Media Network noted that it was important for the Court to develop principles related to freedom of expression in the light of present day conditions and to consider how the established principles applied in the digital media context. Many UN, EU and OECD guidelines referred to media neutrality and technological neutrality when addressing the digital media environment. The present case provided a key opportunity to review the existing definition of ‘journalist’. The EU guidelines pointed out that there was a need to go beyond the notion of traditional journalists and widen its scope for the benefit of those whose freedom of expression should be protected. An extended scope could also have an impact on the balancing test and its possible reassessment. The Court should further elaborate on whether the concept of ‘chilling effect’ should be viewed differently in the new media environment.

Access to information was one of the cornerstones of participation in democratic debate and a precondition for the media in the performance of their role of public watchdog. Many countries had different traditions when it came to making information public. In Finland, transparency was a highly important societal value. NORDPLUS Law and Media Network concluded that the Court's case-law needed further clarification in order to reduce the uncertainty that existed in the field of freedom of expression and the right to privacy in the digital media environment.

ARTICLE 19, the Access to Information Programme and Társaság a Szabadságjogokért noted that the CJEU had in 2008 adopted a wide definition of journalism in its case Satakunnan Markkinapörssi. The Committee of Ministers of the Council of Europe had also defined a journalist broadly as ‘any natural or legal person who [was] regularly or professionally engaged in the collection and dissemination of information to the public via any means of mass communication’. In Ireland, the High Court had extended the journalistic privilege to bloggers, and the UN Special Rapporteur on Freedom of Expression had noted in his 2015 report that persons other than professional journalists carried out a ‘vital public watchdog role’. The Court should therefore not set the standard of protection under Article 10 any lower than mentioned above.

Disclosure of public personal data could contribute to the good of society by creating transparency and accountability around the actions of those who wielded power within society or, conversely, were engaged in unlawful conduct. Publication of such information did not merely satisfy the curiosity of readers but contributed substantially to the pursuit of public interest journalism. These arguments became even stronger if the personal data had previously been published by the State or had otherwise been deemed public under national legislation. The fact that such information was made public implied that there was a public interest regarding access to such information. The public interest in publishing such information outweighed privacy considerations and, once publication had taken place, the information could no longer be regarded as inherently private.

The Court notes at the outset that the present case is unusual to the extent that the taxation data at issue were publicly accessible in Finland. Furthermore, as emphasised by the applicant companies, they were not alone amongst media outlets in Finland in collecting, processing and publishing taxation data such as the data which appeared in Veropörssi. Their publication differed from that of those other media outlets by virtue of the manner and the extent of the data published.

In addition, as also indicated in paragraph 81 above, only a very small number of Council of Europe member States provide for public access to taxation data, a fact which raises issues regarding the margin of appreciation which Finland enjoys when providing and regulating public access to such data and reconciling that access with the requirements of data protection rules and the right to freedom of expression of the press.

Given this context and the fact that at the heart of the present case lies the question whether the correct balance was struck between that right and the right to privacy as embodied in domestic data protection and access to information legislation, it is necessary, at the outset, to outline some of the general principles deriving from the Court's case-law on Article 10 and press freedom, on the one hand, and the right to privacy under Article 8 of the Convention in the particular context of data protection on the other.

Bearing in mind the need to protect the values underlying the Convention and considering that the rights under Articles 10 and 8 of the Convention deserve equal respect, it is important to remember that the balance to be struck by national authorities between those two rights must seek to retain the essence of both (see also Delfi AS v. Estonia [GC], no. 64569/09, § 110, ECHR 2015).

The Court notes that, by virtue of the decisions of the domestic data protection authorities and courts, the first applicant company was prohibited from processing taxation data in the manner and to the extent that had been the case in 2002 and from forwarding that information to an SMS service. Those courts found that the collection of personal data and their processing in the background file of the first applicant company could not as such be regarded as contrary to the data protection rules, provided, inter alia, that the data had been protected properly. However, considering the manner and the extent to which the personal data in the background file had subsequently been published in Veropörssi, the first applicant company, which was found not to be able to rely on the journalistic purposes derogation, had processed personal data concerning natural persons in violation of the Personal Data Act. The second applicant company was prohibited from collecting, storing or forwarding to an SMS service any data received from the first applicant company's database and published in Veropörssi (see paragraph 23 above).

The Court finds that the Data Protection Board's decision, as upheld by the national courts, entailed an interference with the applicant companies’ right to impart information as guaranteed by Article 10 of the Convention.

In the light of paragraph 2 of Article 10, such an interference with the applicant companies’ right to freedom of expression must be ‘prescribed by law’, have one or more legitimate aims and be ‘necessary in a democratic society’.

The expression ‘prescribed by law’ in the second paragraph of Article 10 not only requires that the impugned measure should have a legal basis in domestic law, but also refers to the quality of the law in question, which should be accessible to the person concerned and foreseeable as to its effects (see, amongst many authorities, Delfi AS, cited above, § 120, with further references).

As regards the requirement of foreseeability, the Court has repeatedly held that a norm cannot be regarded as a ‘law’ within the meaning of Article 10 § 2 unless it is formulated with sufficient precision to enable a person to regulate his or her conduct. That person must be able — if need be with appropriate advice — to foresee, to a degree that is reasonable in the circumstances, the consequences which a given action may entail. Those consequences need not be foreseeable with absolute certainty. Whilst certainty is desirable, it may bring in its train excessive rigidity, and the law must be able to keep pace with changing circumstances. Accordingly, many laws are inevitably couched in terms which, to a greater or lesser extent, are vague, and whose interpretation and application are questions of practice (see further Delfi AS, cited above, § 121; and Centro Europa 7 S.r.l. and Di Stefano v. Italy [GC], no. 38433/09, § 141, ECHR 2012).

The role of adjudication vested in the national courts is precisely to dissipate such interpretational doubts as may remain. The Court's power to review compliance with domestic law is thus limited, as it is primarily for the national authorities, notably the courts, to interpret and apply domestic law (see, amongst other authorities, Kudrevičius and Others v. Lithuania [GC], no. 37553/05, § 110, ECHR 2015, with further references). Moreover, the level of precision required of domestic legislation — which cannot provide for every eventuality — depends to a considerable degree on the content of the law in question, the field it is designed to cover and the number and status of those to whom it is addressed (see Delfi AS, cited above, § 122; and Kudrevičius, cited above, § 110).

The Court has found that persons carrying on a professional activity, who are used to having to proceed with a high degree of caution when pursuing their occupation, can on this account be expected to take special care in assessing the risks that such activity entails (see Delfi AS, cited above, § 122, with further references; and, in the context of banking data, G.S.B. v. Switzerland, no. 28601/11, § 69, 22 December 2015).

In the present case, the applicant companies and the Government (see paragraphs 102 and 107 above respectively) differed as to whether the interference with the applicant company's freedom of expression was ‘prescribed by law’.

As regards the existence of a clear legal basis for the impugned interference, the Court finds no reason to call into question the view taken by the Supreme Administrative Court in the instant case that the impugned interference had a legal basis in sections 2(5), 32 and 44(1) of the Personal Data Act (see paragraph 22 above).

As regards the foreseeability of the domestic legislation and its interpretation and application by the domestic courts, in the absence of a provision in the domestic legislation explicitly regulating the quantity of data which could be published and in view of the fact that several media outlets in Finland were also engaged in publication of similar taxation data to some extent, the question arises whether the applicant companies could be considered to have foreseen that their specific publishing activities would fall foul of the existing legislation, bearing in mind in this connection the existence of the journalistic purposes derogation.

For the Court, the terms of the relevant data protection legislation and the nature and scope of the journalistic derogation on which the applicant companies sought to rely were sufficiently foreseeable and those provisions were applied in a sufficiently foreseeable manner following the interpretative guidance provided to the Finnish court by the CJEU. The Personal Data Act transposed the Data Protection Directive into Finnish law. According to the Act, the processing of personal data meant the collection, recording, organisation, use, transfer, disclosure, storage, manipulation, combination, protection, deletion and erasure of personal data, as well as other measures directed at personal data (see paragraph 34 above). It seems reasonably clear from this wording and from the relevant preparatory work (see paragraph 36 above) that there was a possibility that the national competent authorities would one day arrive at the conclusion, as they did in this case, that a database established for journalistic purposes could not be disseminated as such. The quantity and form of the data published could not exceed the scope of the derogation and the derogation, by its nature, had to be restrictively interpreted, as the CJEU clearly indicated.

Even if the applicant companies’ case was the first of its kind under the Personal Data Act, that would not render the domestic courts’ interpretation and application of the journalistic derogation arbitrary or unpredictable (see Kudrevičius, cited above, § 115; and, mutatis mutandis, in relation to Article 7 of the Convention, Huhtamäki v. Finland, no. 54468/09, § 51, 6 March 2012, with further references), nor would the fact that the Supreme Administrative Court sought guidance from the CJEU on the interpretation of the derogation in Article 9 of the Data Protection Directive. Indeed, as regards the latter, the Court has regularly emphasised the importance, for the protection of fundamental rights in the EU, of the judicial dialogue conducted between the domestic courts of EU Member States and the CJEU in the form of references from the former for preliminary rulings by the latter (see Bosphorus Hava Yolları Turizm ve Ticaret Anonim Şirketi v. Ireland [GC], no. 45036/98, § 164, ECHR 2005-VI; and Avotiņš v. Latvia [GC], no. 17502/07, §§ 105 and 109, ECHR 2016).

Moreover, the applicant companies were media professionals and, as such, they should have been aware of the possibility that the mass collection of data and its wholesale dissemination — pertaining to about one third of Finnish taxpayers or 1.2 million people, a number 10 to 20 times greater than that covered by any other media organisation at the time — might not be considered as processing ‘solely’ for journalistic purposes under the relevant provisions of Finnish and EU law.

In the instant case, following their requests for data from the National Board of Taxation in 2000 and 2001, the applicant companies were requested by the Data Protection Ombudsman to provide further information regarding those requests and were told that the data could not be disclosed if Veropörssi continued to be published in its usual form. Instead of complying with the request for more information of the Ombudsman, the applicant companies circumvented the usual route for journalists to access the taxation data sought and organised for the latter to be collected manually at the local tax offices (see paragraph 12 above). It is not for the Court to speculate on the reasons why they acted in this way but the fact that they did suggests some anticipation, on their part, of difficulties in relying on the journalistic purposes derogation and the relevant national legislation on access to taxation data.

Furthermore, the 1992 version of the Guidelines for Journalists — reproduced in 2005, 2011 and 2014 — indicated clearly that the principles concerning the protection of an individual also applied to the use of information contained in public documents or other public sources and that the mere fact that information was accessible to the public did not always mean that it was freely publishable. These guidelines, which were intended to ensure self-regulation by Finnish journalists and publishers, must have been familiar to the applicant companies.

In light of the above considerations, the Court concludes that the impugned interference with the applicant companies’ right to freedom of expression was ‘prescribed by law’.

The parties did not in substance dispute that the interference with the applicant companies' freedom of expression could be regarded as pursuing the legitimate aim of protecting ‘the reputation and rights of others’.

However, the applicant companies argued that while the need to protect against violations of privacy might be a relevant consideration, it was one which the Finnish legislator had already taken into account, assessed and accepted when adopting the Personal Data Act. In their view, the alleged need to protect privacy in the instant case was abstract and hypothetical. Any threat to privacy had been practically non-existent and, in any event, the case was not at all about the privacy of isolated individuals.

The Court notes that, contrary to the suggestions of the applicant companies, it emerges clearly from the case file that the Data Protection Ombudsman acted on the basis of concrete complaints from individuals claiming that the publication of taxation data in Veropörssi infringed their right to privacy. As is clear from the figures indicated in paragraph 9 above, a very large group of natural persons who were taxpayers in Finland had been directly targeted by the applicant companies' publishing practice. It is arguable that all Finnish taxpayers were affected, directly or indirectly, by the applicant companies' publication since their taxable income could be estimated by readers by virtue of their inclusion in or exclusion from the lists published in Veropörssi.

Leaving aside the question whether it would have been necessary to identify individual complainants at national level, the applicant companies’ argument fails to appreciate the nature and scope of the duties of the domestic data protection authorities pursuant to, inter alia, section 44 of the Personal Data Act and the corresponding provisions of the Data Protection Directive. As regards the latter, it is noteworthy that the CJEU has held that the guarantee of the independence of national supervisory authorities was established in order to strengthen the protection of individuals and bodies affected by the decisions of those authorities. In order to guarantee that protection, the national supervisory authorities must, in particular, ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data (see the CJEU judgment in the Schrems case, cited in paragraph 76 above). The protection of privacy was thus at the heart of the data protection legislation for which these authorities were mandated to ensure respect.

In the light of the above considerations and taking into account the aims of the Data Protection Convention, reflected in Directive 95/46 and, more recently, in Regulation 2016/79 (see paragraphs 59 and 67 above), it is clear that the interference with the applicant companies' right to freedom of expression pursued the legitimate aim of protecting ‘the reputation or rights of others’, within the meaning of Article 10 § 2 of the Convention.

The core question in the instant case, as indicated previously, is whether the interference with the applicant companies' right to freedom of expression was ‘necessary in a democratic society’ and whether, in answering this question, the domestic courts struck a fair balance between that right and the right to respect for private life.

Having outlined above — see paragraphs 120–138 ‒ some general principles relating to the rights to freedom of expression and respect for private life, as well as why Article 8 of the Convention is clearly engaged in circumstances such as these, the Court considers it useful to reiterate the criteria for balancing these two rights in the circumstances of a case such as the present one.

The applicant companies submitted that the legal proceedings in the present case had lasted eight years at three levels of jurisdiction, each jurisdiction examining the case twice. It would have been within the power of the Supreme Administrative Court to issue the order of prohibition in its first decision in 2009, without referring the case back to the Data Protection Board. This could have been done in the name of procedural economy and with due regard for the applicant companies’ right to a fair trial within a reasonable time. The length of the proceedings had thus violated the applicant companies’ right guaranteed by Article 6 § 1 of the Convention.

The Government disagreed with the Chamber's findings. They considered that, excluding the time taken for the preliminary reference to the CJEU, the first set of proceedings had lasted three years and three and a half months and the second some two years and three months. The total length had therefore been five years and seven months, from which six months should be deducted as it related to the preparation at national level of that preliminary reference. The overall length was thus five years and seven days.

The Government noted that none of the procedural stages had lasted very long. The case had involved two separate sets of proceedings as the subject-matter of the two sets of proceedings was not the same, in spite of the fact that the proceedings related to the same parties and the same facts. The first set of proceedings had concerned the issue of whether the applicant companies had processed personal data in conflict with the provisions of the Personal Data Act. The Supreme Administrative Court had quashed the appealed decision and referred the matter back to the Data Protection Board, which had to conduct a new administrative consideration of the matter and to make a new administrative decision. The second set of proceedings had concerned the question of whether the Data Protection Board's new decision of 26 November 2009 had corresponded to the previous Supreme Administrative Court's decision.

The Government noted that the matter was exceptionally complex from a legal point of view. In addition to the normal preparation of the case, it also included the drafting of the request to the CJEU for a preliminary ruling, the related interlocutory decision and two hearings. The present case was the first of its kind where the freedom to impart taxation information and data protection concerns were dealt with by the national authorities. No prior domestic case-law existed on this subject.

Furthermore, the applicant companies' conduct had prolonged the second set of proceedings by one and a half months, a delay which could not be attributed to the Government.

The Government concluded that in view of the particular circumstances of the case, the proceedings had been conducted within a reasonable time within the meaning of Article 6 § 1 of the Convention.

The Court notes that the period to be taken into consideration began on 12 February 2004 when the Data Protection Board's first decision was appealed against, and ended on 18 June 2012 when the Supreme Administrative Court gave a final decision in the case. However, the case was pending before the Court of Justice of the European Union for a preliminary ruling for one year and ten months which, according to the Court's case-law to be excluded from the length attributable to the domestic authorities (see Pafitis and Others v. Greece, 26 February 1998, § 95, Reports of Judgments and Decisions 1998-I; and Koua Poirrez v. France, no. 40892/98, § 61, ECHR 2003-X). When deducting this duration from the overall duration, the impugned proceedings before the domestic authorities and courts lasted over six years and six months at two levels of jurisdiction, of which both levels twice.

The Court reiterates that the reasonableness of the length of proceedings must be assessed in the light of the circumstances of the case and with reference to the following criteria: the complexity of the case, the conduct of the applicants and the relevant authorities and what was at stake for the applicants in the dispute (see, among many other authorities, Frydlender v. France [GC], no. 30979/96, § 43, ECHR 2000-VII).

The Court agrees with the Government that there has not been any particularly long period of inactivity on the part of the authorities and domestic courts. The proceedings were pending before the domestic authorities and courts for approximately one and a half years for each stage, which cannot be considered excessive. The excessive total length seems to have been caused by the fact that the case was examined twice by each level of jurisdiction.

The Court considers that even though the case was of some complexity, it cannot be said that this in itself justified the entire length of the proceedings. Some of this complexity may have been caused by the fact that the case was referred back to the Data Protection Board for a new examination.

The Court has frequently found a violation of Article 6 § 1 of the Convention in cases raising issues similar to the one in the present case (see Frydlender v. France, cited above).

Having examined all the material submitted to it, the Court considers that, even taking into account the complexity of the case, the Government have not put forward any fact or argument capable of persuading it to reach a different conclusion in the present case. Having regard to its case-law on the subject, the Court considers that in the instant case the length of the proceedings was excessive and failed to meet the ‘reasonable time’ requirement.

There has accordingly been a breach of Article 6 § 1 of the Convention.