You are here:

CJEU Case C-25/17 / Opinion

Proceedings brought by Tietosuojavaltuutettu

Policy area:
Information society
Deciding Body type:
Court of Justice of the European Union
Deciding Body:
Advocate General
Decision date:

Key facts of the case:

Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Scope — Definition of purely personal or household activity — Data collected and processed by the members of a religious community in the context of their door-to-door proselytising — Freedom of religion — Article 10(1) of the Charter of Fundamental Rights of the European Union — Definition of filing system — Definition of controller of the processing of personal data.

Outcome of the case:


Having regard to all the foregoing considerations, I propose that the Court answer the questions referred for a preliminary ruling by the Korkein hallinto-oikeus (Supreme Administrative Court, Finland) as follows:

  1. Door-to-door proselytising such as that at issue in the main proceedings does not fall within the exemption provided for in the first and second indents of Article 3(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
  2. Article 3(1) of Directive 95/46, read in conjunction with Article 2(c) of that directive, must be interpreted as meaning that the set of personal data collected, otherwise than by automatic means, by members of a religious community, in the context of an activity such as that at issue in the main proceedings, on the basis of a specific geographical allocation and for the purposes of preparation for subsequent visits to people with whom a spiritual dialogue has been begun, is capable of constituting a filing system.
  3. Article 2(d) of Directive 95/46 must be interpreted as meaning that a religious community arranging proselytising activity in connection with which personal data is collected may be regarded as a controller even though it does not itself have access to the personal data collected by its members. For the purposes of determining the ‘controller’ within the meaning of Directive 95/46, there need be no written instructions, but it must be established, if appropriate by means of a body of evidence, that the controller is in a position to exert influence de facto over the activity of collecting and processing the personal data, which it is for the referring court to ascertain.