| Applicant name | JEHOVAH’S WITNESSES |
| Applicant type | Community |
| Number of applicants | 1 |
| Country | Finland |
| Application no. | 31172/19 |
| Date | 09/05/2023 |
| Judges | Arnfinn Bårdsen, President, Jovan Ilievski, Egidijus Kūris, Pauliine Koskelo, Lorraine Schembri Orland, Diana Sârcu, Davor Derenčinović |
| Institution | Court |
| Type | Judgment |
| Outcome Art. 8 | No violation |
| Reason | Fair balance (rights and freedoms of others) |
| Type of privacy | Informational privacy |
| Keywords | Preaching; data processing; group right; ratione persona; exhaustion domestic remedies |
| Facts of the case | The Jehovah’s Witnesses Finland collects data about individuals in relation to its door-to-door preaching activities, e.g. to send people who know sign language to deaf people and those that know foreign languages to immigrants. Because such amounts to processing sensitive personal data for the purposes of the EU General Data Protection Regulation, and no explicit consent had been obtained from the data subjects, and no other legitimate ground was found, a violation of the right to data protection was established by the Data Protection Board. On appeal, the Administrative Court dismissed the appeal without examining the merits and thus found that an oral hearing was manifestly unnecessary, concluding that it had not been shown that the data collected by individual members would constitute a personal file for the use of the applicant community over which it exercised any authority. Accordingly, it annulled the Board’s decision. The Supreme Administrative Court, subsequently, requested a preliminary ruling by the CJEU. The EU court found that the community could not invoke the so called household exemption (processing personal data for purely personal or household purposes does not fall within the scope of the GDPR), that the applicant community could be considered a controller, jointly with its members who engage in preaching, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing. In a subsequent appeal, the applicant community submitted its further submissions to the Supreme Administrative Court, requesting, inter alia, that an oral hearing be held before that court and requested that an expert in religious matters and twenty-four individual Jehovah’s Witnesses be called to give evidence in court. The Supreme Administrative Court, however, stressed that the decision of the Board only concerned the applicant community and that it would not rule on whether individual Jehovah’s Witnesses separately should be considered as controllers. The court quashed the Administrative Court’s decision in so far as it had annulled the Board’s decision, thereby bringing the latter into force. The court rejected the applicant community’s request for an oral hearing since all twenty-four witnesses had already submitted their testimony in writing, which had been taken into consideration when making the decision. It reemphasised the finding of the CJEU that the household exemption did not apply, and that the fact that some individual Jehovah’s Witnesses might create friendships or acquaintanceships with some of the individuals whose personal data were in their notes, or that part of the personal data collected might have been obtained from public sources, was immaterial. The court held it established that making notes containing personal data was related to the preparation of upcoming door-to-door preaching visits. Even though the methods and techniques used by each individual Jehovah’s Witness to record and organise personal data might differ, would not make sense to take notes if, at the same time, the data were not being organised in such a manner to allow them to be found easily. Even if individual Jehovah’s Witnesses themselves decided the territory in which they would be engaging in door-to-door preaching, this did not mean that the applicant community could not be viewed as participating in the distribution of operational areas for door-to-door preaching. The congregations of the applicant community maintained publisher cards recording how many of the community’s publications a member had distributed and how much time he or she had spent on evangelism. The applicant community had actually taken part in determining the purposes and means of the processing of personal data, and it had to be viewed as a controller of the personal data files created in the course of door‑to-door preaching jointly with individual Jehovah’s Witnesses who took notes containing personal data. As a controller, the applicant community was responsible for the requirements of the Personal Data Act being met. |
| Analysis | The case is relevant for a number of reasons: 1. Under Article 8 ECHR, there is an interesting tension between the right to privacy and the right to data protection. The Council of Europe’s ECHR only explicitly acknowledges a right to privacy, under which it also provides protection to many aspects of the right to data protection. For the European Union, the right to privacy and the right to data protection are two independent fundamental rights. Although the Council of Europe took the lead in laying down data protection principles, especially through two Resolutions in 1973 and 1974, and the Convention 108 from 1981, the EU took the lead through the 1995 Data Protection Directive, replaced by the General Data Protection Regulation from 2016. In particular for the purposes of the ECHR, the difference between the two rights is relevant, because under the right to data protection, the question of ratione personae and of ratione materiae are merged, and because there is no de minimis rule. This means that if a person writes on a blog ‘Macron has blue eyes’, such falls under the scope of the GDPR, while it would generally not fall under the protective scope of the ECHR. 2. The complicated relationship between the two rights was discussed during the adoption of the Data Protection Directive. If private conduct of citizens relating to the processing of personal data, for example sending a letter or an e-mail to a loved one, would now be strictly regulated, including oversight by the governmental data protection authority, such would undermine their right to privacy. That is why the household exemption was adopted by the EU, a provision that was not part of the CoE’s data protection regimes, but was included in its 2018 Convention 108+. One of the core questions in this case is whether the household exemption applies. No, argued the CJEU, because the processing was not solely for personal or household activities. But that does not mean, of course, that applicant cannot rely on Article 8 ECHR, which has a broad scope, an includes a wide range of aspects, including engaging with others, even strangers, in public and private places. Thus, this would mean a conflict between the right to privacy of the applicant and the right to data protection of the third parties whose data are processed. The third parties could also invoke their right to privacy; though the data were mostly collected not in the homes, but at the doorsteps, and thus quasi-public space, third parties have a reasonable expectation of privacy in quasi-public spaces as well. 3. Crucial to this case is also the notion of sensitive data, as included in Convention 108 and the subsequent EU data protection instruments. The categories of data that were regarded as sensitive consisted of a combination of data that were considered especially private (thus deriving from Article 8 ECHR protection) and those that were seen as having a potential risk for discrimination (thus stemming from Article 14 ECHR protection). In principle, the processing of these data is prohibited; in this sense, data protection legislation tries to do justice to the protection of classic human rights. But there has always been a special position for organisations that need to process sensitive data, such as medical institutions (health data), political parties (political convictions) and religious organisations (religious and philosophical beliefs) (article 9 GDPR; there is even a special provision on churches, Article 91 GDPR, and many EU countries have adopted special data protection rules for religious institutions). Thus again, a tension may arise between the right of religious organisations and members to process personal data in light of their faith (both under the GDPR and under the human rights framework), and the rights of third parties not to be affected by those activities (both under the GDPR and under the human rights framework). 4. What makes this case complicated is that the main applicant is the religious organisation. Here again, a difference between the right to privacy and the right to data protection is visible. Under the right to privacy, the ECtHR has traditionally held that given its personal and private character, and in contrast to other rights, such as the freedom of expression and religion, legal persons can in principle not invoke that right. Although since 2002, the ECtHR has marginally revised that principled stance, the ECtHR is still hesitant in attributing a right to privacy to legal persons. Under EU legislation, in principle, only natural persons can invoke the right to data protection, while data controllers (those processing data of natural persons and thus subject to the obligations under the GDPR) can be both natural and legal persons. To make things more complicated, Convention 108 explicitly underlined countries the discretion to include legal persons under the protective scope of the data protection regime, and while Convention 108+ does not make that explicit, it does give a discretion to countries to adopt additional protective measures, and the explanatory memorandum points out that several countries have done so with respect to legal persons. 5. What makes the case at hand more complicated is that the claim is brought by the Jehovah’s Witnesses, while the actual processing in most cases is done by natural persons being followers of their faith. To what extent the organisation as such is coordinating the data processing remains unclear throughout the legal proceedings. The CJEU finds that presumably the natural persons and the community most be considered joint controllers for the purposes of the GDPR. This finding does not exclude the possibility that the natural persons could rely on the household exemption, while that exemption in the GDPR makes clear that it can only be invoked by natural persons. This would mean that the community is responsible for the activities of its members, even where it is unclear to what extent they determine or control their behaviour and even when these members themselves do not need to abide by the GDPR. As such, a different rule for accountability seems prevail under data protection law than under most prevailing civil and criminal law doctrines. 6. Groups, as such, are not granted a protective status under the EU data protection instruments, but under instruments such as Data Protection Impact Assessment, group interests can and sometimes need to be taken into account. In addition, several obligations of data controllers are based on the risks for vulnerably groups, which may take those into account. An important additional difference between especially the EU data protection instruments and the CoE’s human rights framework is that the latter is based almost exclusively (safe inter-state complaints, which are seldom used) on subjective rights, while EU data protection regimes and the obligations contained therein apply without it being necessary that any individual has invoked a right or filed a complaint. Data Protection Authorities can impose sanctions without having had a data subject complaint. Convention 108 mentioned explicitly that countries were allowed to extent data protection to groups, while that phrase has been removed under Convention 108+. Presumably that does not mean that countries are disallowed from providing additional protection on this point, but that would raise again a tension between data protection and the ECHR, as the ECtHR has traditionally held that groups as groups cannot rely on one of the Convention rights, e.g. the gay community or a religious community, as a group cannot suffer from harm as such. Individual members of a group can rely on such rights, also when claiming to be a victim by virtue of being a group member, for example when media or politicians publish offensive statements about the gay community. In such a case, applicants would have to prove that they have suffered from significant harm as an individual member, while they can do so by referring to general statements about the group they belong to. 7. Thus, at least formally, the ECtHR holds onto its principle that it will not accept claims of groups; at the same time, an individual does not need to point to individual circumstances to substantiate individual harm, but can point to the nature of statements or actions and the vulnerability of the group as such. It might be wondered whether the ECtHR would at some point in time also accept group claims as such, therewith overturning its earlier jurisprudence on this point, just like it did with its previous doctrine under which legal persons were not allowed to invoke Article 8 ECHR, and like it did with its principled choice not to allow for in abstracto claims, which it overturned in the Zhakarov case. The Jehovah’s case is not the case in which the ECtHR overturns its stance on group claims, as the applicant, perhaps given the standing doctrine on group claims, makes a remarkable move. It stresses that it does not invoke its own right to privacy, but complains under Article 8 ECHR that the Board’s order had violated the privacy rights of individual Jehovah’s Witnesses, because they had been “prohibited, on pain of a sanction and fine, from making notes containing their personal opinions and observations of conversations to which they were party”. Thus, the applicant merely performs a representative function, protecting human rights on behalf of its members. 8. The applicant submits that the data that were processed concerned public, general and non-sensitive data, like a person’s name and address and other data that were widely available in the public domain. This again points to a potential difference between the right to privacy and the right to data protection. With respect to the later right, the relative unimportance and publicness of data does not have an impact on the question of whether the GDPR applies, while processing of very mundane and publicly available data may fall short of the de minimis rule under the ECHR. The other way around, it is important that to the extent this argument also applies to the sensitive personal data that were processed, there is a difference between the two regimes as well. The GDPR contains the rule that to the extent the data subject has manifestly made sensitive data public, data controllers are allowed to process such data. By contrast, the ECtHR has held that even when persons make sensitive personal data about themselves public on the internet, such does not deprive them of a reasonable expectation of privacy. 9. The Court observes that the only applicant before it is the Jehovah’s Witnesses religious community, not any of its individual members, that the applicant community was the only party in the proceedings before the domestic authorities, that the only attempt by two individual adherents to join the domestic proceedings was to no avail, that the Administrative Court dismissed the appeal submitted by the individual members, that these findings remained uncontested before the Supreme Administrative Court and that the CJEU unambiguously established that the members of the Jehovah’s Witnesses Community were not parties to the main proceedings. It was only in its last written submissions to the Supreme Administrative Court, more than five years after the proceedings had been instituted, that the applicant community argued, for the first time, that the Board’s order had violated individual Jehovah’s Witnesses’ right to privacy. Accordingly, the complaint is declared inadmissible by the ECtHR as it is incompatible ratione personae with the provisions of the Convention and should be rejected because the domestic remedies were not exhausted. This finding is a bit puzzling because it seems that it is either/or. Either the applicant relies on Article 8 ECHR on behalf of its members, in which case it might be argued that it did not sufficiently raise that point in the domestic proceedings, so that that claim must be rejected for the non-exhaustion of domestic remedies, or the applicant community invokes its own right to privacy, in which case the claim may be rejected ratione persona, because under the standing approach of the ECtHR, groups cannot claim human rights on their own account. 10. The applicant also complains of a violation of Article 1 Protocol 12 and Article 14 ECHR. The latter provision contains the prohibition of discrimination, the former guarantees that the enjoyment of any right set forth by law shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status. On this point, the ECtHR points out that the applicant community made no reference in the domestic proceedings to the Evangelical Lutheran Church and the Orthodox Church in respect of which it alleged, for the first time before the ECtHR, that it was treated differently without any objective and reasonable justification. The Court notes that the exemption of those churches from imposing an administrative fine was firstly introduced into Finnish law with the Data Protection Act that entered into force on 1 January 2019; that was after the proceedings before the Supreme Administrative Court had been completed. Remarkably, the ECtHR acknowledges that the applicant had raised such concerns before the supreme administrative court, but that court only dealt with that claim very succinctly. That, for the Court, is not an indication that the Supreme Administrative Court did not adequately address this point (at another point in the ECtHR speaks admirably of the length of the Supreme Court’s judgement), but to the contrary, it is perceived as an indication that this claim had always been peripheral to the domestic proceedings, and that the applicant had thus not exhausted the domestic remedies on this point. 11. The applicant also invokes the articles 9 and 10 ECHR, this time on its own behalf. For the purposes of this case, the ECtHR considers that the complaint should be analysed only under Article 9, which, in the circumstances, is to be considered lex specialis with regard to Article 10. It underlines that at the heart of its evaluation lies the question whether domestic authorities had struck a fair balance between the community’s right under Article 9 ECHR and the data subjects’ rights under the right to data protection and Article 8 ECHR. – The ECtHR emphasises that although religious freedom is primarily a matter of individual thought and conscience, it also encompasses the freedom to manifest one’s belief alone and in private but also to practise in community with others and in public. It is because the manifestation of religious belief may have an impact on others, the ECtHR points out, the drafters of the Convention qualified this aspect of freedom of religion as set out in Article 9 § 2. It points to the fundamental difference between Article 8, 10 and 11 ECHR on the one hand, which in their second paragraph contain a limitation clause applicable to all elements mentioned in their first paragraph, and Article 9 on the other hand, the second paragraph of which only allows for limitation of some of the rights and freedoms contained in the first paragraph, namely for the freedom to manifest one’s religion or beliefs. This is not a coincidence, the ECtHR emphasises, because it is that sub right that might in particular conflict with the right of others. – Opposing the right to freedom of religion of the applicant are the rights to privacy and data protection. Interestingly, the ECtHR does not discuss whether the minor collection of mostly private scribbles, personal observations and public data is significant enough to pass the de minimis test. From this approach adopted by the ECtHR, three things stand out. First, that the Court essentially sees this case as a conflict between two opposing parties with two opposing subjective rights providing protection to two opposing private interests. This is remarkable because neither the GDPR nor the rationale behind the ECHR supports this approach. The GDPR focusses on general duties of care by data controllers (in this case, the Board had imposed an order); the ECHR suggests that states can limit human rights when such is in the societal interest. Second, the ECtHR emphasises the limited nature of the freedom of religion, while it does not assess whether the harm inflicted on the rights of the third parties is significant enough to bring it under the scope of the Convention. Third, the ECtHR sees its role not so much as to assess whether the limitations on the applicant’s right to religious was prescribed for by law, in the general interest and necessary in a democratic society, but rather to marginally evaluate whether the domestic authorities have properly executed the balancing test when assessing the interests of the various parties at play. 12. The Court accepts that the application of the consent requirement to the collection and processing of personal data in the course of door-to-door preaching constituted an interference with the applicant community’s rights under Article 9 ECHR, but also finds that such was prescribed by law, namely the Data Protection Act. It underlines that even if the applicant community’s case was the first of its kind under the Personal Data Act, that would not render the interpretation and application by the domestic authorities arbitrary or unpredictable. It finds that the limitation pursued the legitimate aim of protecting “the rights and freedoms of others’. As to the necessity test, the ECtHR points out that data subjects had a reasonable expectation of privacy with regard to personal and sensitive data being collected and processed in the course of door‑to‑door preaching. The fact that some personal data might have already been in the public domain neither reduces this expectation nor does it mean that such data need less protection. Interestingly, this test is intrinsic to Article 8 ECHR, but the ECtHR cites CJEU case law in support. The Court emphasises that it cannot see how simply asking for, and receiving, the data subject’s consent would hinder the essence of the applicant community’s freedom of religion. Thus, although this apparently does not mean that this interference did not meet the de minimis requirement, the ECtHR does conclude that the applicant community failed to present any supporting evidence of the alleged “chilling effect” of the Board’s order. Because, moreover, no fine was imposed, the Court concludes that there are no strong reasons to substitute its view for that of the domestic courts and set aside the balancing done by them. 13. Finally, the applicant community complained about the lack of an oral hearing in the domestic proceedings, in violation of Article 6 ECHR. The Court, however, points out that all the arguments of the applicant were taken into account, as well as additional evidence it had submitted; the hearings at national level were fair, the judgements clear and the courts had taken into account all sides of the story. The ECtHR further reiterates that the applicant community had admitted that local congregations of Jehovah’s Witnesses maintained a manual filing system containing personal data about people who wished not to be visited and that notes made by individual Jehovah’s Witnesses served as a memory aid when revisiting those who showed interest. Similarly, it confirmed that it maintained a territory map which aimed to enable orderly contact with residents in the community. The ECtHR also found that there were indications that the applicant community encouraged individual Witnesses to participate in preaching activities and that their notes assisted them to contact and visit people in an organised manner. ‘In such circumstances, and in the absence of any argument pertaining to the credibility of the evidence, it cannot be said that the decisive facts on which the order was based were in dispute between the parties and that they warranted an oral hearing. Furthermore, the Court is satisfied that the legal issues at stake, which were at the core of the proceedings, did not require an oral hearing and that the written procedure provided the applicant community with an opportunity to effectively put forward its arguments. There were therefore exceptional circumstances which justified dispensing with an oral hearing. (§57)’ |
| Other Article violation? | No violation 6, 9, 10, 14 ECHR or 1 Protocol 12 |
| Damage awarded | – |
| Documents | Judgment |