GRAND CHAMBER
CASE OF SATAKUNNAN MARKKINAPÖRSSI OY AND SATAMEDIA OY v. FINLAND
(Application no. 931/13)
JUDGMENT
STRASBOURG
27 June 2017
This judgment is final but it may be subject to editorial revision.
In the case of Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland,
The European Court of Human Rights, sitting as a Grand Chamber composed of:
András Sajó, President,
Işıl Karakaş,
Angelika Nußberger,
Ganna Yudkivska,
Luis López Guerra,
Mirjana Lazarova Trajkovska,
Kristina Pardalos,
Vincent A. De Gaetano,
Paulo Pinto de Albuquerque,
Helen Keller,
Aleš Pejchal,
Jon Fridrik Kjølbro,
Síofra O’Leary,
Carlo Ranzoni,
Armen Harutyunyan,
Pauliine Koskelo,
Marko Bošnjak, judges,
and Lawrence Early, Jurisconsult,
Having deliberated in private on 14 September 2016 and on 5 April 2017,
Delivers the following judgment, which was adopted on the last‑mentioned date:
PROCEDURE
1. The case originated in an application (no. 931/13) against the Republic of Finland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by two Finnish limited liability companies, Satakunnan Markkinapörssi Oy and Satamedia Oy (“the applicant companies”) which had their seat in Kokemäki, Finland, on 18 December 2012.
2. The applicant companies were represented by Mr Pekka Vainio, a lawyer practising in Turku. The Finnish Government (“the Government”) were represented by their Agents, first Mr Arto Kosonen and then Ms Krista Oinonen, both from the Ministry for Foreign Affairs.
3. The applicant companies alleged, in particular, that their right to freedom of expression under Article 10 of the Convention had been violated and that the length of the domestic proceedings had been excessive, in breach of Article 6 § 1 of the Convention.
4. The application was allocated to the Fourth Section of the Court (Rule 52 § 1 of the Rules of Court). On 21 July 2015 a Chamber of that Section, composed of Guido Raimondi, Päivi Hirvelä, George Nicolaou, Nona Tsotsoria, Krzysztof Wojtyczek, Faris Vehabović, and Yonko Grozev, judges, and also of Fatoş Aracı, Deputy Section Registrar, delivered its judgment. It decided by a majority to declare the complaints concerning violation of the right to freedom of expression and the unreasonable length of the proceedings admissible and the remainder of the application inadmissible, and held, by six votes to one, that there had been no violation of Article 10 and, unanimously, that there had been a violation of Article 6 of the Convention. The concurring opinion of Judge Nicolaou and the dissenting opinion of Judge Tsotsoria were annexed to the judgment. On 21 October 2015 the applicant companies requested the referral of the case to the Grand Chamber in accordance with Article 43 of the Convention. On 14 December 2015 the panel of the Grand Chamber granted that request.
5. The composition of the Grand Chamber was determined according to the provisions of Article 26 §§ 4 and 5 of the Convention and Rule 24 of the Rules of Court. At the final deliberations, Helen Keller, substitute judge, replaced Alena Poláčková, who was unable to take part in the further consideration of the case (Rule 24 § 3).
6. The applicants and the Government each filed written observations (Rule 59 § 1) on the merits. In addition, third-party observations were received from the European Information Society Institute, the Nordplus Law and Media Network, Article 19, the Access to Information Programme and Társaság a Szabadságjogokért, which had been given leave by the President to intervene in the written procedure (Article 36 § 2 of the Convention and Rule 44 § 3).
7. A hearing took place in public in the Human Rights Building, Strasbourg, on 14 September 2016 (Rule 59 § 3).
There appeared before the Court:
(a) for the Government
Ms K. Oinonen, Director, Ministry for Foreign Affairs, Agent,
Ms A. Talus, Senior Adviser, Ministry of Justice
Ms H. hynynen, Senior Adviser, Finnish Tax Administration,
Ms S. Sistonen, Legal Officer, Ministry for Foreign Affairs,
Mr A. Kosonen, Director (ret.), Ministry for Foreign Affairs, Advisers;
(b) for the applicant companies
Mr P. Vainio, Lawyer, Counsel.
The Court heard addresses by Ms K. Oinonen and Mr P. Vainio and the replies given by them to questions put by the judges.
THE FACTS
I. THE CIRCUMSTANCES OF THE CASE
A. Background to the case
8. Since 1994 the first applicant company, Satakunnan Markkinapörssi Oy collected data from the Finnish tax authorities for the purpose of publishing information about natural persons’ taxable income and assets in the Veropörssi newspaper. Several other publishing and media companies also publish such data which, pursuant to Finnish law, are accessible to the public (see paragraph 39 below for an explanation of the Finnish access to information regime).
9. In 2002 Veropörssi appeared 17 times, with each issue concentrating on a certain geographical area of the country. The data published comprised the surnames and forenames of approximately 1.2 million natural persons whose annual taxable income exceeded certain thresholds, mainly from 60,000 to 80,000 Finnish marks (approximately 10,000 to 13,500 euros (EUR)), as well as the amount, to the nearest EUR 100, of their earned and unearned income and taxable net assets. When published in the newspaper, the data were set out in the form of an alphabetical list and organised according to municipality and income bracket.
10. The first applicant company worked in cooperation with the second applicant company, Satamedia Oy, and both were owned by the same shareholders. In 2003 the first applicant company started to transfer personal data published in Veropörssi, in the form of CD-ROM discs, to the second applicant company which, together with a mobile telephone operator, started a text-messaging service (SMS service). By sending a person’s name to a service number, taxation information could be obtained concerning that person, on the requesting person’s mobile telephone, if information was available in the database or register created by the second applicant company. This database was created using personal data already published in the newspaper and transferred in the form of CD-ROM discs to the second applicant company. From 2006 the second applicant company also published Veropörssi.
11. It transpires from the case file that in 1997 the Minister of Justice requested that the police instigate a criminal investigation into the publishing activities of the applicant companies. No information is contained in the file as to the outcome of this request or of any subsequent investigation.
12. In September 2000 and November 2001, the applicant companies ordered taxation data from the Finnish National Board of Taxation (verohallitus, skattestyrelsen). Following the first order, the Board requested an opinion from the Data Protection Ombudsman, on the basis of which the Board invited the applicant companies to provide further information regarding their request and indicating that the data could not be disclosed if Veropörssi continued to be published in its usual form. The applicant companies subsequently cancelled their data request and paid people to collect taxation data manually at the local tax offices.
B. First set of proceedings (2004 – 2009)
1. Decisions of the Data Protection Ombudsman and the Data Protection Board
13. On an unspecified date, probably in 2003, the Data Protection Ombudsman (tietosuojavaltuutettu, dataombudsmannen) contacted the applicant companies and advised them that, although accessing and publishing taxation data were not prohibited as such, they had to cease publishing such data in the manner and to the extent that had been the case in 2002, when they had published data concerning the 2001 tax year. The applicant companies refused to abide by this request, which they considered violated their right to freedom of expression.
14. By a letter of 10 April 2003 the Data Protection Ombudsman asked the Data Protection Board (tietosuojalautakunta, datasekretessnämnden) to prohibit the applicant companies from processing the taxation data in the manner and to the extent that had been the case in 2002 and from passing those data to the SMS service. He claimed that under the Personal Data Act the companies had no right to collect, store or pass on personal data and that the derogation provided by that Act concerning journalism did not, in his view, apply to the present case. The collecting of taxation information and the passing of such information to third parties were not for journalistic purposes and therefore were not covered by the derogation in the Personal Data Act, but rather constituted the processing of personal data in which the applicant companies had no right to engage.
15. On 7 January 2004 the Data Protection Board dismissed the Data Protection Ombudsman’s request. It found that the derogation laid down in the Personal Data Act concerning journalism applied to the present case. As regards the SMS service, the data used in the service had already been published in Veropörssi and therefore the Act did not apply to it.
2. Decision of the Helsinki Administrative Court (2005)
16. By letter dated 12 February 2004 the Data Protection Ombudsman appealed to the Helsinki Administrative Court (hallinto-oikeus, förvaltningsdomstolen) reiterating his request that the applicant companies be prohibited from processing taxation data in the manner and to the extent that had been the case in 2002 and from passing such data to the SMS service.
17. On 29 September 2005 the Administrative Court rejected the appeal. It found that the derogation laid down in the Personal Data Act concerning journalism, which had its origins in Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data was adopted (OJ 1995 L 281, p. 31, hereafter “the Data Protection Directive”), should not be interpreted too strictly, as an overly strict interpretation would favour protection of privacy over freedom of expression. That court considered that Veropörssi had a journalistic purpose and that it was also in the public interest to publish such data. It emphasised, in particular, that the published data were already accessible to the general public. The journalism derogation thus applied in the circumstances of the present case. As regards the SMS service, the Administrative Court agreed with the Data Protection Board that, as the information had already been published in the newspaper, the Act did not apply to it.
3. Appeal to the Supreme Administrative Court (2005)
18. By letter dated 26 October 2005 the Data Protection Ombudsman lodged an appeal with the Supreme Administrative Court (korkein hallinto-oikeus, högsta förvaltningsdomstolen), reiterating the grounds of appeal already presented before the Helsinki Administrative Court.
19. On 8 February 2007 the Supreme Administrative Court decided to request a preliminary ruling from the Court of Justice of the European Communities (which became the Court of Justice of the European Union on 1 December 2009, hereafter the “CJEU”) on the interpretation of Directive 95/46/EC.
4. Preliminary ruling of the CJEU (2008)
20. On 16 December 2008 the Grand Chamber of the CJEU handed down its judgment (see Case C-73/07 Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy and Satamedia Oy, EU:C:2008:727). It found, first of all, that the activities in question constituted “processing of personal data” within the meaning of Article 3(1) of Directive 95/46. According to the CJEU, activities involving the processing of personal data such as those relating to personal data files which contained solely, and in unaltered form, material that had already been published in the media, also fell within the scope of the Directive (see paragraphs 37 and 49 of the judgment). The object of the derogation in Article 9 of the Directive for the processing of personal data carried out solely for journalistic purposes was to reconcile the protection of privacy with freedom of expression. In order to take account of the importance of the latter in every democratic society, it was necessary to interpret notions relating to that freedom, such as journalism, broadly. However, in order to achieve a balance between those two fundamental rights, the protection of the fundamental right to privacy required that the derogations and limitations in relation to the protection of data had to apply only in so far as were strictly necessary (see paragraphs 54 and 56 of the judgment). Journalistic activities were not limited to media undertakings and could be undertaken for profit-making purposes (see paragraph 61). Furthermore, when interpreting the journalistic purposes derogation, account must be taken of the evolution and proliferation of methods of communication and the dissemination of information. Activities such as those involved in the domestic proceedings, relating to data from documents which were in the public domain under domestic legislation, could be classified as “journalistic activities” if their sole object was the disclosure to the public of information, opinions or ideas, irrespective of the medium which was used to transmit them. Whether or not that was the case, was for the national court to determine (see paragraphs 60-62 of the judgment).
5. Decision of the Supreme Administrative Court (2009)
21. On 23 September 2009 the Supreme Administrative Court, applying the ruling of the CJEU and with reference to the case-law on Article 10 of the Convention, quashed the impugned decisions of the Data Protection Board and the Helsinki Administrative Court and referred the case back to the Data Protection Board for a fresh examination with a view to issuing an order pursuant to section 44(1) of the Personal Data Act. The Supreme Administrative Court requested the Board to prohibit the processing of taxation data by the applicant companies in the manner and to the extent carried out in 2002.
22. In its legal assessment, the Supreme Administrative Court gave the following reasoning:
“Scope of the matter
The present case does not concern the question of the extent to which taxation data and official documents concerning taxation are public under the Act on the Public Disclosure and Confidentiality of Tax Information.
Nor does it concern the right to publish taxation data as such but only the processing of personal data. Therefore, there is no issue of possible prior interference with the content of the publications, but rather an assessment of whether the legal conditions set for personal data processing and protection of privacy are fulfilled.
The reconciliation of protection of privacy with freedom of expression is part of the legal assessment of personal data processing in the matter.
...
Reconciliation of the protection of privacy and freedom of expression
Interpretation of the exception concerning journalistic purposes in the Data Protection Directive. The Court of Justice of the European Communities emphasised that the purpose of the Data Protection Directive is to ensure that when processing their personal data, the Member States guarantee individuals’ fundamental rights and freedoms, and in particular their right to privacy, while allowing the free movement of such information. The Court further emphasised that these fundamental rights must be reconciled to a certain extent with the fundamental right to freedom of expression, and that this task belongs to the Member States.
...
It therefore appears from the aforementioned ruling of the Court of Justice of the European Communities that the concept of journalism must, as such, be interpreted broadly within the meaning of Article 9 of the Directive, that, on the other hand, the protection of privacy can be derogated from only in so far as it is strictly necessary, and that this task of reconciliation of the two fundamental rights is the task of the Member States. Ensuring proper balance between the rights and interests at stake, including the fundamental rights guaranteed in the Communities’ legal order, is the task of the domestic authorities and courts (see also case C-101/01 Lindqvist).
Interpretation of the exception in the Personal Data Act concerning journalistic purposes. ... It transpires from the preparatory work on the Personal Data Act (HE 96/1998 vp) that the purpose of the adoption of the Personal Data Act was to maintain the existing situation in respect of journalistic files kept by the media, provided it remained within the limits imposed by the Data Protection Directive. Therefore, in order to conclude that processing of personal data is conducted for journalistic purposes within the meaning of the Personal Data Act, inter alia, that data must be used solely for journalistic activities and the data must not be made available to persons other than those involved in those journalistic activities.
When interpreting section 2(5) of the Personal Data Act, particular regard must be had to the fact that it concerns the reconciliation of two fundamental rights, namely the freedom of expression and the protection of privacy.
...
The case-law of the European Court of Human Rights has also adopted a position on reconciling freedom of expression with the protection of privacy. The Court has held, inter alia in its von Hannover judgment of 24 June 2004, that the press plays an essential role in a democratic society. Although it must not overstep certain bounds, in particular in respect of the reputation and rights of others, its duty is nevertheless to impart, in a manner consistent with its obligations and responsibilities, information and ideas on all matters of public interest.
On the other hand, the Court also held in the above-mentioned judgment that increased vigilance as regards the protection of private life was necessary in order to contend with the new communications technologies which make it possible to store and reproduce personal data.
According to the Court, when balancing the protection of private life against freedom of expression, the decisive criterion had to be the contribution made by publishing the data to a debate of public interest. If a publication is only meant to satisfy the curiosity of a certain audience, freedom of expression must be interpreted more narrowly.
In the present case, it must be assessed to what extent the impugned processing of personal data as carried out in the course of the companies’ activities falls within the scope of the exception concerning journalistic purposes that is provided for in section 2(5) of the Personal Data Act. The starting point is whether the aim of their activities was to disclose information, opinions or ideas to the public. In this assessment, account must be taken of whether or to what extent those activities can be seen as contributing to a debate in a democratic society rather than solely satisfying the curiosity of certain individuals.
Processing of personal taxation data in the background file of Satakunnan Markkinapörssi Oy and in the Veropörssi newspaper
Satakunnan Markkinapörssi Oy collected for the Veropörssi newspaper taxation data from different tax offices in which individuals’ names appear together with information on their taxable income.
As mentioned above, the case concerns the processing of personal data to which the general requirements in Chapter 2 of the Personal Data Act are applicable, unless the Act allows for an exception from the application of these provisions. It must first of all be assessed whether the processing of personal data in the company’s background file before the publication of such data in the Veropörssi newspaper falls within the scope of the exception concerning journalistic purposes.
From the preparatory work on the amendment of the Personal Data File Act (HE 311/1993 vp), which was the Act in force before the Personal Data Act, it transpires in particular that the press considers that the right to freely disclose information also requires journalists to be able, in advance, to freely collect and store information. Restricting the processing of personal data at this stage, that is to say before publication, could in practice mean that a prior decision is taken on what can be published. Such an outcome would be incompatible with the fundamental right guaranteeing freedom of expression.
The issue at stake in the present case concerns publicly accessible personal data received from the tax authorities. The collection and processing of such data in the company’s internal files for the purpose of the company’s publishing activities can, on the basis of above-mentioned grounds, be regarded as processing of personal data for journalistic purposes. The processing of large quantities of such data from the various municipal taxation records may well be necessary as background information for the purpose of the editing of a publication concerning taxation and from the point of view of free communication and open debate. At this stage of activities the protection of the privacy of the persons concerned can also be sufficiently secured, provided that the data collected and stored in the file are protected against unlawful processing as required by section 32 of the Personal Data Act.
Satakunnan Markkinapörssi Oy has published the personal data collected from the tax offices as wide-ranging municipality-based catalogues in the Veropörssi newspaper. As already stated above, in this regard too it is a question of processing personal data within the meaning of section 3(2) of the Personal Data Act. As part of the case file, the Supreme Administrative Court had at its disposal Veropörssi newspaper no. 14/2004, published by Satakunnan Markkinapörssi Oy and covering the Helsinki metropolitan area.
In this respect it must be decided whether a derogation is possible from the requirements relating to the processing of personal data on the basis of section 2(5) of the Act, that is to say whether the impugned processing of personal data by publishing those data in the Veropörssi newspaper came within the scope of the exception provided for journalistic purposes.
...
It transpires from the preparatory work on the Personal Data Act (HE 96/1998 vp) that the processing of data in the background file referred to in the Personal Data File Act must relate solely to journalistic activities and that the processed data must not be made available to any persons not engaged in journalistic activities. The purpose of section 2(5) of the Personal Data Act was to maintain the existing situation in respect of journalistic files kept by the media, within the limits allowed by the Data Protection Directive. Therefore, the purpose of the Personal Data Act in this respect can be seen as guaranteeing the possibility for free journalistic work prior to the publication of information.
The term “processing of personal data for journalistic purposes” cannot be regarded as covering the large–scale publication of the journalistic background file, almost verbatim, as catalogues, albeit split into different parts and sorted by municipality.
Since the disclosure of registered data on such a scale is equivalent to the disclosure of the entire background file kept for journalistic purposes by the company, such disclosure does not represent solely an expression of information, opinions or ideas. As stated above, with a view to reconciling the requirements of freedom of expression with the protection of privacy, the collection of data before publication has been made permissible under section 2(5) of the Personal Data Act without any requirement of compliance with general conditions set out in section 8 of the Act. By contrast, the processing of personal data collected in the company’s background file by publishing it and by rendering it available to the general public to the extent that has been done in the present case, and beyond the scope of the minimum requirements set out in section 2(5) of the Act, cannot be regarded as compatible with the purpose of the Personal Data Act.
Open public-interest debate, the monitoring of the exercise of power in society and the freedom to criticise, which are necessary in a democratic society, do not require the disclosure of the personal data of specific individuals in the manner and to the extent described above. When regard is also had to the foregoing comments on the narrow interpretation of section 2(4) of the Personal Data Act and the fact that a strict literal interpretation of that provision would result in a situation incompatible with the purpose of the Act as regards protection of personal data, the processing of personal data with a view to publishing them in the Veropörssi newspaper, and as far as the contents of this publication itself are concerned, was not conducted for journalistic purposes within the meaning of the Personal Data Act.
...
Having regard to sections 2(5) and 32 of the Personal Data Act and Article 9 of the Data Protection Directive, as interpreted by the Court of Justice of the European Communities in its preliminary ruling, the collection of personal data prior to its publication in the Veropörssi newspaper and its processing in the background file of Satakunnan Markkinapörssi Oy cannot as such be regarded as contrary to the regulations concerning the protection of personal data, provided that, inter alia, the data have been protected properly. However, with reference to all the clarifications on how and to what extent the personal data in the background file were further processed in the Veropörssi newspaper, Satakunnan Markkinapörssi Oy did in fact process personal data concerning natural persons in violation of the Personal Data Act.
Handover of data in a CD-ROM
Satakunnan Markkinapörssi Oy handed over a CD-ROM containing the published data to Satamedia Oy so that the latter could start up an SMS service using that data. As mentioned above, that action amounts to the processing of personal data within the meaning of section 3(2) of the Personal Data Act.
Having regard to the preliminary ruling of the Court of Justice of the European Communities and its effect on the interpretation of section 2(4) of the Personal Data Act, as well as all that has been said above about the processing of personal data in the Veropörssi newspaper, the handover to Satamedia Oy of personal data collected in the background file of Satakunnan Markkinapörssi Oy, even though they were published in the Veropörssi newspaper, cannot be regarded as processing of personal data for journalistic purposes within the meaning of Personal Data Act. Nor can the processing of personal data in such a manner be regarded as having been effected for journalistic purposes within the meaning of Article 9 of the Data Protection Directive. Therefore, in that regard too, Satakunnan Markkinapörssi Oy processed personal data in violation of the Personal Data Act.
Processing of personal data for the realisation of a SMS service by Satamedia Oy
As stated above in the “Facts” section, Satamedia Oy handed over the above-mentioned personal data to a third company in order to start up a SMS service, which company operated the SMS service on behalf of Satamedia Oy.
It was pointed out above that Satakunnan Markkinapörssi Oy had no right under the Personal Data Act to process the personal data at issue by handing it over to Satamedia Oy. Consequently, Satamedia Oy also had no right under the Personal Data Act to process personal data received in this manner.
In addition, it follows from the preliminary ruling of the Court of Justice of the European Communities that the exception provided for in the Data Protection Directive, which concerns the processing of personal data for journalistic purposes, requires the disclosure of data to the public. According to section 2(1) of the Act on the Exercise of Freedom of Expression in Mass Media, the term “the public” in that Act refers to a group of freely determined message recipients. Satamedia Oy’s SMS service involves the company processing personal data relating to the taxation of a specific individual on the basis of a request by another individual. It therefore does not concern disclosure of data to the general public, as explained above, but replying to a request by an individual concerning the personal data of another individual.
Open public-interest debate, the monitoring of the exercise of power in society and the freedom to criticise, which are necessary in a democratic society, do not require the possibility of processing the personal data of specific individuals as has been done in this case. Freedom of expression does not require any derogation from the protection of privacy in such a situation.
The Court of Justice of the European Communities further stated in its preliminary ruling that the technical means used for the transfer of information is not relevant when assessing whether there is any question of activities undertaken solely for journalistic purposes. As regards the SMS service operated by Satamedia Oy, it is irrelevant that the data were transferred via mobile phones and text messages. Therefore, this is not a case of treating this mode of transmission of data differently from other modes of transmission. The assessment would be the same if the company processed, on the basis of a request by an individual, the personal data of another individual by using some other mode of transmission.”
C. Second set of proceedings (2009 – 2012)
23. Pursuant to the above-mentioned judgment of the Supreme Administrative Court, on 26 November 2009 the Data Protection Board prohibited the first applicant company from processing taxation data in the manner and to the extent that had been the case in 2002 and from forwarding that information to an SMS service. It found that the collection of personal data prior to its publication in Veropörssi and its processing in the background file of the first applicant company could not as such be regarded as contrary to the data protection rules, provided, inter alia, that the data had been protected properly. However, considering the manner and the extent to which the personal data in the background file had been published in Veropörssi, the first applicant company had processed personal data concerning natural persons in violation of the Personal Data Act. The second applicant company was prohibited from collecting, storing or forwarding to an SMS service any data received from the first applicant company’s database and published in Veropörssi.
24. By letter dated 15 December 2009, after the Data Protection Board had made its decision, the Data Protection Ombudsman asked the applicant companies to indicate what action they were envisaging in response to the Board’s decision. In their reply, the applicant companies asked for the Data Protection Ombudsman’s views on the conditions under which they could continue to publish public taxation data at least to a certain extent. In his reply the Data Protection Ombudsman stated, with reference to the decision of the Data Protection Board of 26 November 2009, that “when data on taxable income were collected in a database and published in large catalogues almost as it stood, the Personal Data Act was applicable...”. He reminded them of his duty to report any breach of the Personal Data Act to the police.
25. By letter dated 9 February 2010 the applicant companies appealed against the decision of the Data Protection Board to the Helsinki Administrative Court, which transferred the case to the Turku Administrative Court. They complained that the decision violated the Constitutional prohibition of censorship as well as their right to freedom of expression. According to the applicants, under domestic law, it was not possible to prevent publication of information on the basis of the amount of information to be published or of the means used for its publication. Nor was it possible to rely on the “public interest” as a criterion for preventing publication where preventive restriction of freedom of expression was concerned. Accepting that would mean that the authorities would be able to prevent publication if they thought that the publication did not promote discussion of a topic of public interest.
26. On 28 October 2010 the Turku Administrative Court rejected the applicant companies’ appeal. It found that the Supreme Administrative Court had stated in its decision of 2009 that the case concerned neither the public accessibility of taxation data nor the right to publish such information per se. As the court was now examining only the 2009 decision rendered by the Data Protection Board, it could not examine the issues which the Supreme Administrative Court had excluded from the scope of its 2009 decision. As the Board’s decision corresponded to the content of the latter decision, there was no reason to change it.
27. By letter dated 29 November 2010 the applicant companies further appealed to the Supreme Administrative Court.
28. On 18 June 2012 the Supreme Administrative Court upheld the judgment of the Turku Administrative Court, reiterating that the case concerned neither the right to publish taxation information as such, nor preventive censorship.
D. Subsequent developments
29. According to the information submitted by the applicants, the SMS service was shut down after the 2009 decision of the Supreme Administrative Court was served on the applicant companies. The newspaper continued publishing taxation data in autumn 2009 when its content was only one fifth of the previous content. Since then the newspaper has not appeared. The Government, on the other hand, submitted that, according to the applicant companies’ website, Veropörssi was still being published on a regional basis in 2010 and 2011. Moreover, an Internet service continued to operate allowing anyone to request a natural person’s tax data concerning the year 2014 by filling in a form on the website in question. The requested tax information would then be delivered to the customer by phone call, text message or e-mail.
30. The editor-in-chief of Veropörssi lodged an application with the Court in 2010, complaining that the impugned decision of the Supreme Administrative Court violated his right to freedom of expression. On 19 November 2013 the application was declared inadmissible as being incompatible ratione personae with the provisions of the Convention (see Anttila v. Finland (dec.), no. 16248/10, 19 November 2013).
31. The first applicant company was declared bankrupt on 15 March 2016. The bankruptcy administration did not oppose the continuation of the present proceedings before the Court (see paragraph 94 below).
II. RELEVANT DOMESTIC LAW AND PRACTICE
A. Constitutional provisions
32. Article 10 of the Constitution of Finland (Suomen perustuslaki, Finlands grundlag, Act no. 731/1999), which protects the right to private life, states:
“Everyone’s private life, honour and the sanctity of the home are guaranteed. More detailed provisions on the protection of personal data are laid down by an Act...”
33. Article 12 of the Constitution, which guarantees the freedom of expression, provides:
“Everyone has the freedom of expression. Freedom of expression entails the right to express, disseminate and receive information, opinions and other communications without prior prevention by anyone. More detailed provisions on the exercise of the freedom of expression are laid down by an Act. Provisions on restrictions relating to pictorial programmes that are necessary for the protection of children may be laid down by an Act.”
B. Personal Data Act
1. Provisions of the Personal Data Act
34. The relevant provisions of the Personal Data Act (henkilötietolaki, personsuppgiftslagen, Act no. 523/1999, as in force at the relevant time) provided:
“Chapter 1 – General provisions
Section 1 – Objectives
The objectives of this Act are to implement, in the processing of personal data, the protection of private life and the other basic rights which safeguard the right to privacy...
Section 2 – Scope
(1) The provisions of this Act apply to the processing of personal data, unless otherwise provided elsewhere in the law.
(2) This Act applies to the automatic processing of personal data. It applies also to other processing of personal data where the data constitute or are intended to constitute a personal data file or a part thereof.
...
(4) This Act does not apply to personal data files containing, solely and in unaltered form, data that have been published by the media.
(5) Unless otherwise provided in section 17, only sections 1-4, 32, 39(3), 40(1) and (3), 42, 44(2), 45-47, 48(2), 50, and 51 of this Act apply, where appropriate, to the processing of personal data for purposes of journalism or artistic or literary expression.
Section 3 – Definitions
In this Act,
(1) personal data means any information on a private individual and any information on his or her personal characteristics or personal circumstances, where these are identifiable as concerning him or her or the members of his or her family or household;
(2) processing of personal data means the collection, recording, organisation, use, transfer, disclosure, storage, manipulation, combination, protection, deletion and erasure of personal data, as well as other measures directed at personal data;
(3) personal data file means a set of personal data, connected by a common use and processed fully or partially automatically or sorted into a card index, directory or other manually accessible form so that the data pertaining to a given person can be retrieved easily and at reasonable cost;
(4) controller means a person, corporation, institution or foundation, or a number of them, for the use of whom a personal data file is set up and who is entitled to determine the use of the file, or who has been designated as a controller by an Act;
(5) data subject means the person to whom the personal data pertain;
...
Section 32 – Data security
(1) The controller shall carry out the technical and organisational measures necessary for securing personal data against unauthorised access, against accidental or unlawful destruction, manipulation, disclosure and transfer and against other unlawful processing...
...
Section 44 – Orders of the Data Protection Board
At the request of the Data Protection Ombudsman, the Data Protection Board may:
(1) prohibit processing of personal data which is contrary to the provisions of this Act or the rules and regulations issued on the basis of this Act...
...
(3) order that the operations pertaining to the file be ceased, if the unlawful conduct or neglect seriously compromise the protection of the privacy of the data subject or his or her interests or rights, provided that the file is not set up under a statutory scheme;
...”
35. Following the judgment of the CJEU of 2008 in the present case (see Satakunnan Markkinapörssi Oy and Satamedia Oy, cited above), section 2(4) of the Personal Data Act was repealed by an Act enacted on 3 December 2010.
36. Government Bill to Parliament HE 96/1998 vp provides background information regarding the journalistic purposes derogation in section 2(5) of the Personal Data Act. The definition of a database for journalistic purposes was derived from the previous Act but was modified in order to transpose the Data Protection Directive. According to the preparatory work, “a database for journalistic purposes means such databases as are intended to be used only in the context of the journalistic activity of the media and which are not accessible to others”. “Media” is taken to mean any kind of mass media, including news and photo agencies when they keep databases containing personal data used in media’s publishing activities or a news agency’s own publishing activities. Information collected for storage in a database for journalistic purposes can be used only in the context of a journalistic activity, and not, for example, for administrative or marketing purposes. It is also required that the circle of users of the database is limited such as to be accessible only to those persons involved in the journalistic activity. A database for journalistic purposes can be kept, for example, by a newspaper publisher, an individual journalist or a free-lance journalist.
2. Examples of application of the Personal Data Act
37. In a decision of 23 January 2015, the Helsinki Administrative Court held that public taxation data could be provided to media in mass deliveries in electronic format. However, neither freedom of expression as a fundamental right nor the preparatory work relating to legislation on the publicity of and access to taxation data supported an interpretation of the law to the effect that the applicant in that case – a representative of a media organisation which had requested data relating to 5.2 million persons (all natural persons earning more than 1 euro in Finland) – had the right to receive such data in electronic format for journalistic purposes.
38. In contrast, in his opinion of 5 July 2013, addressed to a complainant on another matter, the Data Protection Ombudsman held that the media organisation in question (Helsingin Sanomat) had processed data for journalistic purposes within the meaning and scope of the section 2(5) derogation. The latter had not published all of the personal data files collected by it for journalistic purposes, but had published data on a limited group of 10,000 persons considered to be the wealthiest people in Finland. The data published were accompanied by articles and presentations on some of those featured.
C. Act on the Public Disclosure and Confidentiality of Tax Information
39. Sections 1-3 of the Act on the Public Disclosure and Confidentiality of Tax Information (laki verotustietojen julkisuudesta ja salassapidosta, lagen om offentlighet och sekretess i fråga om beskattningsuppgifter, Act no. 1346/1999) provide the following:
“Section 1 – Scope of the Act
This Act applies to documents concerning individual taxpayers which are submitted to or prepared by the tax administration (taxation documents) and the information contained therein (taxation information). The provisions concerning the taxpayer in this Act apply to other persons required to report information, and also to joint tax corporations.
...
Section 2 – Relation to other provisions
The provisions of the Act on the Openness of Government Activities (621/1999) and the Personal Data Act (523/1999) apply to taxation documents and information unless otherwise provided by this or some other Act.
Section 3 – Public disclosure of and right of access to taxation information
Taxation information is public to the extent provided in this Act.
Everyone has the right to obtain information on a public taxation document in the possession of the tax administration as provided by the Act on the Openness of Government Activities, unless otherwise provided by this Act.”
40. According to section 5 of the Act, information on a taxpayer’s name, year of birth and municipality of domicile is public, as is the following information:
“(1) earned income taxable in State taxation;
(2) capital income and property taxable in State taxation;
(3) income taxable in municipal taxation;
(4) income and taxable net assets, municipal tax and the total amount of taxes and charges imposed;
(5) the total amount of withholding tax;
(6) the amount to be debited or the amount to be refunded in the final assessment for the tax year.
...
The information referred to above in this section may be disclosed at the beginning of the November following the tax year, as valid on completion of the taxation.”
41. The preparatory work relating to section 5 of the Act indicates that the special regulation in section 16(3) of the Act on the Openness of Government Activities is applicable to data referred to in this section. It also indicates that the Personal Data Act does not restrict the collection of data for journalistic purposes and that the media can be given data referred to in section 5 for journalistic purposes, provided that there are no restrictions imposed by the rules on confidentiality.
D. Act on the Openness of Government Activities
42. Section 1 (1) of the Act on the Openness of Government Activities (laki viranomaisten toiminnan julkisuudesta, lagen om offentlighet i myndigheternas verksamhet, Act no. 621/1999) provides that:
“Official documents shall be in the public domain, unless specifically provided otherwise in this Act or another Act.”
43. According to section 3 of the Act,
“[t]he objectives of the right of access and the duties of the authorities provided in this Act are to promote openness and good practice on information management in government, and to provide private individuals and corporations with an opportunity to monitor the exercise of public authority and the use of public resources, to freely form an opinion, to influence the exercise of public authority, and to protect their rights and interests.”
44. Section 9 of the same Act provides that every person has a right of access to an official document in the public domain.
45. According to section 13(2) of the Act:
“When requesting access to a secret document, a personal data filing system controlled by an authority or any other document, access to which can be granted only subject to certain conditions, the person requesting access shall, unless specifically provided otherwise, declare the use to which the information is to be put, as well as give the other details necessary for determining whether the conditions have been met and, where necessary, explain what arrangements have been made for the protection of the information.”
46. According to section 16(1)-(3) of the same Act,
“[a]ccess to an official document shall be by explaining its contents orally to the requester, by giving the document to be studied, copied or listened to in the offices of the authority, or by issuing a copy or a printout of the document. Access to the public contents of the document shall be granted in the manner requested, unless this would unreasonably inconvenience the activity of the authority owing to the volume of the documents, the inherent difficulty of copying or any other comparable reason.
Access to the public information in a computerised register of the decisions of an authority shall be provided by issuing a copy in magnetic media or in some other electronic form, unless there is a special reason to the contrary. Similar access to information in any other official document shall be at the discretion of the authority, unless otherwise provided in an Act. ...
Access may be granted to a personal data filing system controlled by an authority in the form of a copy or a printout, or an electronic-format copy of the contents of the system, unless specifically otherwise provided in an Act, if the person requesting access has the right to record and use such data according to the legislation on the protection of personal data. However, access to personal data for purposes of direct marketing, polls or market research shall not be granted unless specifically provided otherwise or unless the data subject has consented to the same.”
47. Section 21(1) of the Act provides the following:
“When requested to do so, an authority may compile and deliver a set of data formed from signs contained in one or more computerised information management systems and maintained for various purposes, if such delivery is not contrary to the provisions on document secrecy and the protection of personal data owing to the search criteria used, the volume or quality of the data or the intended use of the set of data.”
48. In the travaux préparatoires relating to the Act (Government Bill to Parliament HE 30/1998 vp., p. 48), it is expressly stated that access and dissemination are subject to separate legal regimes, although it is clear that the two are linked in that access to official documents facilitates and supports the activity and the function of the media in society. The fact that a document is in the public domain, in the sense that it is publicly accessible, does not automatically mean that it would be lawful to publish information contained in such a document where such information relates to a person’s private life (see Government Bill to Parliament HE 184/1999 vp., p. 32). Thus, for example, public access to court records does not in itself make it lawful for a person accessing such information to publish or disseminate it further, if such publication or dissemination would interfere with the privacy rights of the persons concerned (see Government Bill to Parliament HE 13/2006 vp., p. 15).
E. Instructions issued by the Tax Administration
49. According to instructions issued by the Tax Administration (verohallinto, skatteförvaltningen), anyone can view information on natural persons’ taxable income and assets at local tax offices. Prior to 2010 this information was in paper format but it is now accessible digitally on terminals made available for those who request it. Access to this information in digital format was, at the time of the relevant facts, restricted to journalists. The information is made available to the public for viewing, making notes and taking photos only. Printing or copying the information on memory sticks or other media, or copying it digitally and sending it by e-mail is technically blocked and not possible. Extracts from the lists are available for a fee of 10 euros each, and data may also be delivered by telephone. The information is not made available on the Internet.
50. Previously, the lists of natural persons were compiled for each municipality separately but now they are compiled on a regional basis. As a result, information on a taxpayer’s municipality no longer features in the publicly accessible data.
51. Since 2000 the National Board of Taxation can disclose, for a fee, data in digital format for journalistic purposes. Any person requesting data in digital format for journalistic purposes must specify the purpose for which the data is to be used. Such persons must declare that “the information is requested for journalistic purposes” and that “the information will not be published as such in the form of a list”, by ticking a box next to the text of the declaration. The order form has contained these boxes since 2001.
52. Since 2013 ordering such data has been free of charge but, at the same time, the tax authorities introduced additional retrieval conditions explicitly stating that the ordering of the whole database was not possible. The amount of data accessible free of charge and in digital format is now limited to a maximum of 10,000 persons for the whole country or 5,000 persons for a specific region. If data are selected on the basis of income, the limit for earned income for the whole country or a specific region is at least 70,000 euros and the limit for capital income is 50,000 euros. The order is effected by filling in a digital form available at the Tax Administration’s website (www.vero.fi).
F. Self-regulation by journalists and publishers
53. Guidelines for Journalists (Journalistin ohjeet, Journalistreglerna) have been established for the purposes of self-regulation.
54. The 1992 Guidelines were in force at the material time and provided the following (point 29):
“The principles concerning the right to privacy also apply when publishing information from public documents or other public sources. The public availability of information does not always necessarily imply that it can be freely published.”
The same principles are reiterated in the 2005, 2011 and the current 2014 version of the Guidelines (point 30).
III. RELEVANT EUROPEAN UNION, INTERNATIONAL AND COMPARATIVE LAW MATERIAL
A. European Union law
1. Charter of Fundamental Rights of the European Union
55. Article 8, paragraphs 1 and 2, of the Charter provides:
“Protection of personal data
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which have been collected concerning him or her, and the right to have them rectified.”
56. Article 11 of the Charter reads as follows:
“Freedom of expression and information
1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.
2. The freedom and pluralism of the media shall be respected.”
57. Article 52, paragraph 3, of the Charter provides that, in so far as the Charter contains rights which correspond to rights guaranteed by the Convention, the meaning and scope of those rights shall be the same as those laid down by the Convention. This provision of the Charter does not prevent EU law from providing more extensive protection.
58. According to the explanations relating to the Charter, Article 8 is based, inter alia, on Article 8 of the Convention and on the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data (hereafter the “Data Protection Convention”), which has been ratified by all EU Member States. Similarly, Article 11 of the Charter is said to correspond to Article 10 of the Convention.
2. Data Protection Directive
59. According to Article 1(1) of the Directive, its objective is to protect the fundamental rights and freedoms of natural persons, and, in particular, their right to privacy with respect to the processing of personal data. In accordance with recital 11 of the Directive, the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in the Directive, give substance to and amplify those contained in the aforementioned Data Protection Convention.
60. Personal data are defined in Article 2 (a) as any information relating to an identified or identifiable person. The processing of personal data is defined as “any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction” (see Article 2(b)). A “controller” for the purposes of the Directive is a natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data (see Article 2(d)), whereas a “processor” is a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller (see Article 2(e)).
61. According to Article 3(1), the Directive applies to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
62. It is for the member States, within the limits of Chapter II of the Directive, to determine more precisely the conditions under which the processing of personal data is lawful (see Article 5). In this regard, the Directive provides, inter alia, that the data subject must have unambiguously given his consent or that the processing must be necessary for the performance of a task carried out in the public interest or that the processing must be necessary for the purposes of the legitimate interests pursued by the controller. Derogations from these provisions are provided in well-defined circumstances (see Article 7).
63. Article 9 of the Directive, entitled ‘Processing of personal data and freedom of expression’, provides:
“Member States shall provide for exemptions or derogations from the provisions of this Chapter [II], Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.”
64. In that connection, recital 37 of the Directive is worded as follows:
“Whereas the processing of personal data for purposes of journalism or for purposes of literary or artistic expression, in particular in the audio-visual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of [expression] and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; whereas member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, measures on the transfer of data to third countries and the power of the supervisory authority; whereas this should not, however, lead member States to lay down exemptions from the measures to ensure security of processing; whereas at least the supervisory authority responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report or to refer matters to the judicial authorities.”
65. Pursuant to Article 28(1) and (3) of the Directive, each member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the member States pursuant to the Directive. Each authority so established shall be endowed with the power to engage in legal proceedings where the national provisions adopted pursuant to the Directive have been violated or to bring these violations to the attention of judicial authorities. Decisions by the supervisory authority which give rise to complaints may be appealed against through the Courts.
66. Articles 22 and 23 of the Data Protection Directive provide, respectively, for the right to a judicial remedy for persons whose rights under national law on processing have been breached and the right to compensation for any person who has suffered damage as a result of an unlawful processing operation or act incompatible with national provisions adopted pursuant to the Directive.
3. Regulation (EU) 2016/679
67. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119/1) entered into force on 24 May 2016. It will repeal Directive 95/46/EC as of 25 May 2018 (see Article 99).
68. Recitals 4, 6, 9 and 153 of the new Regulation provide as follows:
“- The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. ... (recital 4);
...
- Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities (recital 6);
...
- The objectives and principles of Directive 95/46/EC remain sound, but it has not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread public perception that there are significant risks to the protection of natural persons, in particular with regard to online activity... (recital 9);
...
- Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes... should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter... In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly (recital 153).”
69. Article 85 of the Regulation, which will replace the journalistic purposes derogation in Article 9 of the Directive, provides as follows:
“1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.”
4. CJEU case-law on data protection and freedom of expression
70. The CJEU has repeatedly held that the provisions of the Data Protection Directive, inasmuch as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to respect for private life, must necessarily be interpreted in the light of the fundamental rights guaranteed by the Convention and the Charter (see variously Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, judgment of 20 May 2003, paragraph 68; Google Spain and Google, C‑131/12, EU:C:2014:317, judgment of 13 May 2014, paragraph 68; and Ryneš, C‑212/13, EU:C:2014:2428, judgment of 11 December 2014, paragraph 29).
71. Given the relevance of Directive 95/46 to the balancing of the fundamental rights to privacy and freedom of expression at issue before the Finnish competent authorities and domestic courts in the instant case, the data protection case-law of the CJEU is set out in some detail.
72. At issue in Österreichischer Rundfunk, cited above, was national legislation which required a State control body, the Court of Audit, to collect and communicate, for purposes of publication, data on the income of persons employed by the bodies subject to its control, where that income exceeds a certain threshold. The purpose of the collection and publication of the information was to exert pressure on public bodies to keep salaries within reasonable limits. The CJEU held that, while the mere recording by an employer of data by name relating to the remuneration paid to his employees cannot as such constitute an interference with private life, the communication of that data to third parties, in the present case a public authority, infringes the right of the persons concerned to respect for private life, whatever the subsequent use of the information thus communicated, and constitutes an interference within the meaning of Article 8 of the Convention. Citing Amann v. Switzerland [GC], no. 27798/95, § 70, ECHR 2000‑II, it also held that to establish the existence of such an interference, it did not matter whether the information communicated was of a sensitive character or whether the persons concerned had been inconvenienced in any way (paragraphs 74-75). Finally, the CJEU held that the interference resulting from the application of the Austrian legislation may be justified under Article 8(2) of the Convention only in so far as the wide disclosure not merely of the amounts of the annual income above a certain threshold of persons employed by the bodies subject to control by the Court of Audit but also of the names of the recipients of that income was both necessary for and appropriate to the aim of keeping salaries within reasonable limits, that being a matter for the national courts to examine (paragraph 90). It emphasised, as regards the proportionality of the interference and the seriousness of the latter, that it was not impossible that the persons affected might suffer harm as a result of the negative effects of the publicity attached to their income from employment (paragraph 89).
73. In Lindqvist (judgment of 6 November 2003, C-101/01, EU:C:2003:596) the CJEU held that the act of referring, on an Internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constituted the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of the Data Protection Directive. Noting that the directive seeks to ensure not only the free flow of such data between Member States but also the safeguarding of the fundamental rights of individuals and that those objectives may be inconsistent with one another, the CJEU held that the mechanisms allowing those different rights and interests to be balanced are contained, first, in the Directive itself, and, second, result from the adoption, by the Member States, of national provisions implementing that directive and their application by the national authorities (paragraphs 79-82). The provisions of the Directive do not, in themselves, bring about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights which are applicable within the EU and are enshrined inter alia in Article 10 of the Convention. It is, according to the CJEU, for the national authorities and courts responsible for applying the national legislation implementing the Directive to ensure a fair balance between the rights and interests in question, including the fundamental rights protected by the EU legal order (paragraphs 83-90).
74. In Volker und Markus Schecke GbR (judgment of 9 November 2010, C-92/09 and C-93/09, EU:C:2010:662), the CJEU held that the obligation imposed by EU regulations to publish on a website data relating to the beneficiaries of aid from EU agricultural and rural development funds, including their names and the income received, constituted an unjustified interference with the fundamental right to the protection of personal data. Referring to Amann, cited above, and Rotaru v. Romania [GC], no. 28341/95, ECHR 2000‑V, it pointed out that the professional nature of the activities to which the data referred did not imply the absence of a right to privacy. The fact that the beneficiaries of aid had been informed that the data might be made public was not sufficient to establish that they had given their consent to its publication. As regards the proportionality of the interference with privacy rights, the CJEU held that it did not appear that the EU institutions had properly balanced the public interest objective in the transparent use of public funds against the rights which natural persons are recognised as having under Articles 7 and 8 of the Charter. Regard being had to the fact that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary, and that it was possible to envisage measures which would have affected less adversely that fundamental right of natural persons and which would still have contributed effectively to the objectives of the European Union rules in question, the CJEU held that the EU regulations in question exceeded the limits which compliance with the principle of proportionality imposes and struck them down.
75. In Google Spain, cited above, the CJEU held that the operations carried out by the operator of an internet search engine must be classified as ‘processing’ within the meaning of the Data Protection Directive regardless of the fact that the data have already been published on the internet and are not altered by the search engine. Inasmuch as the activity of a search engine is liable to affect significantly fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure that the activity meets the requirements of the Directive in order that the guarantees laid down by the Directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved. As regards the derogation in Article 9 of the Directive, while the CJEU did not exclude that processing by the publisher of a web page may, in some circumstances, be carried out ‘solely for journalistic purposes’ and thus benefit from that derogation, the same did not appear to be the case as regards processing carried out by the operator of a search engine. The CJEU also held that the processing of personal data may be incompatible with the Directive not only because the data are inaccurate but, in particular, also because “they are inadequate, irrelevant or excessive in relation to the purposes of the processing, that they are not kept up to date, or that they are kept for longer than is necessary unless they are required to be kept for historical, statistical or scientific purposes” (paragraph 92).
76. In Schrems (judgment of 6 October 2015 (Grand Chamber), C‑362/14, EU:C:2015:650, paragraphs 41-42), the CJEU held that national supervisory authorities must, in particular, ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data. According to the CJEU, legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter (paragraph 95).
77. More recently, in Tele2 Sverige (judgment of 21 December 2016, C‑203/15, EU:C:2016:970), where it had to interpret an EU regulation concerning the processing of personal data and the protection of privacy in the electronic communications sector, whose provisions particularise and complement Directive 95/46 (paragraph 82), the CJEU held, at paragraph 93:
“Accordingly, the importance both of the right to privacy, guaranteed in Article 7 of the Charter, and of the right to protection of personal data, guaranteed in Article 8 of the Charter, as derived from the Court’s case-law [...], must be taken into consideration in interpreting Article 15(1) of Directive 2002/58. The same is true of the right to freedom of expression in the light of the particular importance accorded to that freedom in any democratic society. That fundamental right, guaranteed in Article 11 of the Charter, constitutes one of the essential foundations of a pluralist, democratic society, and is one of the values on which, under Article 2 TEU, the Union is founded [...].”
78. In Connolly v. Commission (judgment of 6 March 2001, C-274/99 P, EU:C:2001:127), a case involving the right to freedom of expression of an EU official and the limitations placed thereon, the CJEU held, at paragraphs 37-42:
“[F]undamental rights form an integral part of the general principles of law, whose observance the Court ensures. For that purpose, the Court draws inspiration from the constitutional traditions common to the Member States and from the guidelines supplied by international treaties for the protection of human rights on which the Member States have collaborated or to which they are signatories. The ECHR has special significance in that respect [...].
As the Court of Human Rights has held, ‘Freedom of expression constitutes one of the essential foundations of [a democratic society], one of the basic conditions for its progress and for the development of every man. Subject to paragraph 2 of Article 10 [of the ECHR], it is applicable not only to ”information” or ”ideas” that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb; such are the demands of that pluralism, tolerance and broadmindedness without which there is no ”democratic society (Eur. Court H. R. Handyside v United Kingdom judgment of 7 December 1976, Series A no. 24, § 49; Müller and Others judgment of 24 May 1988, Series A no. 133, § 33; and Vogt v. Germany judgment of 26 September 1995, Series A no. 323, § 52).
[...]
Those limitations [set out in Article 10(2) of the Convention] must, however, be interpreted restrictively. According to the Court of Human Rights, the adjective ‘necessary’ involves, for the purposes of Article 10(2), a ‘pressing social need’ and, although ‘[t]he contracting States have a certain margin of appreciation in assessing whether such a need exists, the interference must be ‘proportionate to the legitimate aim pursued and ‘the reasons adduced by the national authorities to justify it must be ‘relevant and sufficient (see, in particular, Vogt v. Germany, § 52; and Wille v. Liechtenstein judgment of 28 October 1999, no. 28396/95, § 61 to § 63). Furthermore, any prior restriction requires particular consideration (see Wingrove v. United Kingdom judgment of 25 November 1996, Reports of Judgments and Decisions 1996-V, p. 1957, § 58 and § 60).
Furthermore, the restrictions must be prescribed by legislative provisions which are worded with sufficient precision to enable interested parties to regulate their conduct, taking, if need be, appropriate advice (Eur. Court H. R. Sunday Times v. United Kingdom judgment of 26 April 1979, Series A no. 30, § 49).”
79. In Philip Morris (judgment of 4 May 2016, C-547/14, EU:C:2016:325, paragraph 147), the CJEU confirmed the correlation between Article 10 of the Convention and Article 11 of the Charter:
“Article 11 of the Charter affirms the freedom of expression and information. That freedom is also protected under Article 10 [ECHR], which applies, in particular, as is clear from the case-law of the European Court of Human Rights, to the dissemination by a business of commercial information, including in the form of advertising. Given that the freedom of expression and information laid down in Article 11 of the Charter has — as is clear from Article 52(3) thereof and the Explanations Relating to the Charter as regards Article 11 — the same meaning and scope as the freedom guaranteed by the Convention, it must be held that that freedom covers the use by a business, on the packaging and labelling of tobacco products, of indications such as those covered by Article 13(1) of Directive 2014/40.”
B. Relevant international instruments and comparative law material
1. Council of Europe documents
80. Within the framework of the Council of Europe, the Data Protection Convention formulates a number of core principles for the collection and processing of personal data. The purpose of the Convention is, according to Article 1, to secure respect for every individual’s rights and fundamental freedoms, and in particular his right to privacy, with regard to the automatic processing of personal data relating to him. The Convention includes the following basic principles:
[...]
“Article 5 – Quality of data
Personal data undergoing automatic processing shall be:
a) obtained and processed fairly and lawfully;
b) stored for specified and legitimate purposes and not used in a way incompatible with those purposes;
c) adequate, relevant and not excessive in relation to the purposes for which they are stored;
d) accurate and, where necessary, kept up to date;
e) preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored.
Article 7 – Data security
Appropriate security measures shall be taken for the protection of personal data stored in automated data files against accidental or unauthorised destruction or accidental loss as well as against unauthorised access, alteration or dissemination.
Article 8 – Additional safeguards for the data subject
Any person shall be enabled:
a) to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
b) to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;
c) to obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Articles 5 and 6 of this Convention;
d) to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this Article is not complied with.
Article 9 – Exceptions and restrictions
No exception to the provisions of Articles 5, 6 and 8 of this Convention shall be allowed except within the limits defined in this Article.
Derogation from the provisions of Articles 5, 6 and 8 of this Convention shall be allowed when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of:
a) protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences;
b) protecting the data subject or the rights and freedoms of others.
Restrictions on the exercise of the rights specified in Article 8, paragraphs b, c and d, may be provided by law with respect to automated personal data files used for statistics or for scientific research purposes when there is obviously no risk of an infringement of the privacy of the data subjects.”
The Data Protection Convention is currently being updated.
2. Comparative law material
81. From the information available to the Court, it would appear that, apart from Finland, only Iceland, Italy, France, Monaco, Sweden and Switzerland provide for some form of public accessibility of individual taxation information.
82. In contrast, of the 40 Council of Europe States surveyed, 34 provide, in principle, for the secrecy of personal taxation information. Such data can only be disclosed either with the consent of the person concerned or where disclosure is provided for by law. Exceptions to the secrecy rule exist also for certain types of taxation data (tax debts and exemptions, public registers for business activity) and for data concerning the tax affairs of public officials.
THE LAW
I. THE GOVERNMENT’S PRELIMINARY OBJECTIONS
83. The Government raised two preliminary objections relating to the applicant companies’ alleged failure to lodge their complaints within the six-month time-limit and to their lack of victim status.
A. Six-month time-limit
84. Before the Grand Chamber, the Government reiterated the preliminary objection raised before the Chamber to the effect that the complaints under Articles 6 § 1 and 10 of the Convention had not been lodged within the six-month time-limit regarding the first set of proceedings as required by Article 35 § 1 of the Convention (see paragraphs 13-22 above). Since the subject-matter of the two sets of proceedings was not the same, the present case had in effect involved two separate sets: the first concerning the question whether the applicant companies had processed personal taxation data unlawfully and the second the issuance of orders regarding the processing of personal data. Consequently, in the view of the Government, as regards the first set of proceedings, the application should be declared inadmissible under Article 35 §§ 1 and 4 of the Convention.
85. The applicant companies argued that the initial aim of the Data Protection Ombudsman had been to obtain an order preventing the applicant companies from publishing Veropörssi. Since this was not accomplished until the second round, the proceedings could not be divided into two separate sets each one with independent and separable domestic remedies. Whereas the Supreme Administrative Court had referred the case back to the Data Protection Board in September 2009, it could instead have issued an order directly without such a referral. The applicant companies thus argued that their complaints under Articles 6 § 1 and 10 of the Convention had been lodged within the six-month time-limit.
86. As noted by the Chamber, the first round of proceedings ended on 23 September 2009 when the Supreme Administrative Court quashed the lower court decisions and referred the case back to the Data Protection Board. As the case had been referred back to the Data Protection Board, there was no final decision, but the proceedings continued into a second round. The domestic proceedings became final only on 18 June 2012 when the Supreme Administrative Court delivered its second and final decision in the case (see paragraph 28 above).
87. Like the Chamber, the Grand Chamber considers that, as there was only one final decision, there was only one set of proceedings for the purposes of the six-month time limit for the lodging of applications in Article 35 § 1, although the case was examined twice before the different levels of jurisdiction.
88. In the circumstances, the Government’s first preliminary objection must be dismissed and the complaints under Articles 6 § 1 and 10 of the Convention must be considered as having been introduced within the time-limit.
B. Lack of victim status
89. In the course of the public hearing before the Grand Chamber, the Government raised, for the first time, an additional preliminary objection based on the fact that the first applicant company had been declared bankrupt on 15 March 2016, after the case had been referred to the Grand Chamber, with the result that it lacked victim status for the purposes of Article 34 of the Convention.
90. The Court observes that the Government’s objection is based on the premise that the first applicant company and its assets had, since that date, been managed by the bankruptcy estate and that this change in its legal status had deprived that company of its victim status.
91. It should be noted that it was only in September 2016 that the Government brought this matter to the Court’s attention. The applicant companies, for their part, informed the Court only a day before the hearing of the bankruptcy proceedings and of their representative’s capacity to represent them at the public hearing held on 14 September 2016.
92. The Court would point out that, according to Rule 55 of the Rules of Court, “[a]ny plea of inadmissibility must, in so far as its character and the circumstances permit, be raised by the respondent Contracting Party in its written or oral observations on the admissibility of the application ...”. However, the decision on the admissibility of the application was adopted on 21 July 2015, at which time the fact on which the Government’s objection relies had not yet occurred. Therefore, the Government were not in a position to comply with the time-limit established in Rule 55.
93. The Court sees no need to determine whether the Government are now estopped from making the above objection on account of their delay in raising it (see paragraphs 89-91 above) since it finds in any event that it concerns a matter which goes to the Court’s jurisdiction and which it is not prevented from examining of its own motion (see, for instance, R.P. and Others v. the United Kingdom, no. 38245/08, § 47, 9 October 2012; and Buzadji v. the Republic of Moldova [GC], no. 23755/07, § 70, ECHR 2016 (extracts)).
94. The administrator of the bankruptcy estate did not object to the company continuing to pursue their complaints before the Court, as indicated in a letter sent to the Court on the eve of the public hearing. Bearing in mind that the first applicant company still exists, pursuant to Finnish law, as a separate legal person, although governed by the bankruptcy administration, the Court considers that it can still claim to be a victim of the alleged violations of Articles 6 § 1 and 10 of the Convention.
95. Consequently, the Government’s second preliminary objection is also dismissed.
II. ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION
96. The applicant companies complained that their right to freedom of expression protected by paragraph 1 of Article 10 of the Convention had been interfered with in a manner which was not justified under its second paragraph. The collection of taxation information was not illegal as such and the information collected and published was in the public domain. Individual privacy rights were not violated.
97. Article 10 of the Convention reads as follows:
“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.
2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”
A. The Chamber judgment
98. The Chamber considered that there had been an interference with the applicant companies’ right to impart information, but that that interference had been “prescribed by law” and had pursued the legitimate aim of protecting the reputation or rights of others. As to the necessity of said interference in a democratic society, the Chamber noted that the taxation data in question were already a matter of public record in Finland and, as such, was a matter of public interest. This information had been received directly from the tax authorities and there was no evidence, according to the Chamber, or indeed any allegation, of factual errors, misrepresentation or bad faith on the part of the applicant companies. The only problematic issue for the national authorities and courts had been the manner and the extent to which the information could be published.
99. The Chamber noted that, after having received the preliminary ruling from the CJEU, the Supreme Administrative Court had found that the publication of the whole database containing personal data collected for journalistic purposes could not be regarded as a journalistic activity. It had considered that the public interest did not require publication of personal data to the extent seen in the present case. The same applied also to the SMS service. The Chamber observed that, in its analysis, the Supreme Administrative Court had attached importance both to the applicant companies’ right to freedom of expression and to the right to respect for the private life of those tax payers whose taxation information had been published. It had balanced these interests in its reasoning, interpreting the applicant companies’ freedom of expression strictly, in line with the CJEU ruling on the need for a strict interpretation of the journalistic purposes derogation, in order to protect the right to privacy. The Chamber found this reasoning acceptable. According to the Chamber, the Court would, under such circumstances, require strong reasons to substitute its own view for that of the domestic courts.
100. As regards the sanctions imposed by the domestic authorities, the Chamber noted that the applicant companies had not been prohibited generally from publishing the information in question but only to a certain extent. Their decision to shut down the business was thus not a direct consequence of the actions taken by the domestic courts and authorities but an economic decision made by the applicant companies themselves.
B. The parties’ submissions to the Grand Chamber
1. The applicant companies
101. The applicant companies maintained that the domestic decisions had prevented them from imparting information and had as a consequence impeded them “entirely” from carrying out their publishing activities. The said interference had taken the form of a prior ban. On 1 November every year, when the tax records of the previous year became public, numerous newspapers and other media published personal tax data in paper and electronic formats. This was no different from what the applicant companies had engaged in, apart from the quantity of the published data. The majority of the persons whose data were accessible in this way were not known to the public and were of varying backgrounds and professions. No particular judicial attention had ever been paid to the identity of the persons whose names and amounts of taxable income had been published. Nor had the activities of other media ever been subject to the Data Protection Ombudsman’s scrutiny.
102. The applicant companies argued that this interference with their right to freedom of expression had not been “prescribed by law”. The publishing of taxation data had, in particular, been accepted by the Finnish legislator. The preparatory work relating to the Act on the Public Disclosure and Confidentiality of Tax Information noted that such publishing had taken place for years and also served certain societal purposes. A thorough discussion had taken place during the preparation of the said Act, assessing the pros and cons of publishing taxation data, and the legislator had finally decided to maintain public access to such data. The Personal Data Act was not intended to restrict publishing activities. The relevant preparatory work stated that the legal status of the data in question was to remain unchanged. The journalistic purposes derogation was to apply to databases that were designed to support publishing so as to prevent even indirect prior restrictions on freedom of expression. Possible violations of privacy were to be examined and dealt with ex post facto. On this basis the applicant companies argued that the interference had not been “prescribed by law” within the meaning of Article 10 § 2 of the Convention.
103. The applicant companies also claimed that the interference had not been “necessary in a democratic society”. There had never been any issue as regards the accuracy of the information, only its quantity. The balancing criteria applied by the Court functioned best where the privacy of one or two persons was concerned. In such situations the data relating to a particular individual took prominence. When hundreds of thousands of names were published, all in the same manner, the information concerning a specific person “blended in”. The publication of such data could hardly violate anyone’s privacy. For such situations, a different type of balancing criteria ought to be applied in order to better take into account the nature of the mass data published, namely a criterion for protecting the privacy of a large population. Moreover, when other media had published taxation data on, for example, 150,000 individuals, it had never been requested that this information be viewed in the light of the Court’s balancing criteria. It was only when the applicant companies had published 1.2 million names that such criteria became applicable.
104. The issue of public interest had been examined when the Act on the Public Disclosure and Confidentiality of Tax Information was enacted. According to the applicant companies, public access to tax data enabled the public to observe the results of tax policies and how differences in income and wealth developed, for example, between different regions, occupations and sexes. It also enabled supervision by the Finnish tax administration as people reported their suspicions of tax evasion directly to the tax administration. In 2015 alone, the tax administration had received 15,000 such reports. The applicant companies thus argued that a balance between the public and publishable tax records, on the one hand, and the protection of privacy, on the other hand, had already been struck by the Finnish legislator. Therefore, no margin of appreciation, or at least a very narrow one, was left to the domestic authorities. There was thus no need for any re-balancing. Contrary to Fressoz and Roire v. France [GC], no. 29183/95, ECHR 1999-I, the taxation information in the present case had been obtained lawfully by the applicant companies from public tax records, in the same manner as any other member of the public. The effect on a person’s privacy could not in any significant way be different depending on whether the information had been received from the applicant companies, other media or through a phone-in service operated by the tax administration itself. Since the information had been so readily available, its publication could not violate anyone’s privacy.
105. Referring to the definition of journalistic activities set out in the draft EU General Data Protection Regulation, the applicant companies argued that their publishing activities should be considered as journalism. The reasoning of the Supreme Administrative Court was in contradiction with this definition, which fact was bound to endanger the very idea of freedom of expression. Given the terms of the Supreme Administrative Court’s judgment, one had to ask how much information needed to be published to transgress the limit between publishable and non-publishable information. The quantity and the manner in which taxation information could be lawfully published had, according to the applicant companies, never been defined. The national court had failed to take into account the balancing criteria in the Court’s case-law, and had only had regard to the public interest criterion. There should in any event be no upper limit on the quantity of information publishable.
2. The Government
106. The Government agreed, in essence, with the Chamber’s finding of no violation, but contended that there had been no interference with the applicant companies’ right to impart information. The applicant companies could still collect and publish public taxation data in so far as they complied with the requirements of data protection legislation.
107. In the event that the Court were to find that an interference had occurred, the Government agreed with the Chamber’s finding that the interference was prescribed by law and pursued the legitimate aim of protecting the reputation or rights of others. As to the further question whether any interference had been necessary in a democratic society, the Government shared the Chamber’s view that the general subject-matter, namely taxation data relating to natural persons’ taxable income, was a matter of public interest. Taxation data were publicly available in Finland but had to be accessed and used in conformity with the Personal Data Act and the Act on the Openness of Government Activities. Public access to such information did not imply that that information could always be published. Respect for personal data and privacy under Article 8 of the Convention required the disclosure of such information to be subject to certain controls.
108. The Government emphasised that the applicant companies had requested the data in question from the National Board of Taxation in 2000 and 2001. On the basis of an opinion received by the Board from the Data Protection Ombudsman, the Board had requested the applicant companies to provide further information regarding their request, and indicated that the data could not be disclosed if the publishing methods of Veropörssi continued unchanged. The applicant companies had then cancelled their request while explaining that they would provide information to the Data Protection Ombudsman and the National Board of Taxation the following year, which they never did. Instead, they employed people to collect taxation data manually at the local tax offices.
109. The Government pointed out that, according to the Guidelines for Journalists which were in force at the material time, the right to privacy also applied when publishing public documents or other information originating from public sources. The Guidelines made clear that the public availability of information did not necessarily imply that it could be freely published.
110. The Government noted that, as the domestic courts had made clear, the manner and extent of the publication were of importance. The data published in Veropörssi had encompassed data relating to 1.2 million persons, almost one third of all taxpayers in Finland. Other Finnish media published taxation data concerning 50,000 to 100,000 individuals annually, which was considerably less than the applicant companies. The latter published, without any analysis, data on persons with low or medium income who were not public figures and held no important positions in society. Their publishing activities could not therefore be viewed as data journalism aimed at drawing conclusions from such data and drawing attention to issues of public interest for public debate. Such publishing did not contribute to public debate in a manner that outweighed the public interest in protecting the processing of personal data to the described extent; it mainly satisfied readers’ curiosity. The applicant companies had not been prevented from publishing taxation data as such or participating in any public debate on an issue of general importance.
111. Should the public interest in ensuring the transparency of the taxation data require the possibility of their disclosure by, for instance, publishing the data by the media, the Government took the view that that aim could have been accomplished without processing personal data to the extent prohibited by the Personal Data Act and the Data Protection Directive. The present case differed from Fressoz and Roire v. France, cited above, in which the publishing of data concerned a single person having a key role in a public debate on a socially important issue. Contrary to the applicant companies’ allegations, the present case was not abstract and hypothetical. Private persons had been affected by their activities: between 2000 and 2010 the Data Protection Ombudsman had received a number of complaints requesting his intervention. There was thus a pressing social need to protect private life under Article 8 of the Convention.
112. Concerning the interpretation of the Data Protection Directive, the CJEU had noted in its preliminary ruling in the present case that it was necessary to interpret the notion of journalism broadly and that derogations and limitations in relation to data protection had to apply only insofar as was strictly necessary. The applicant companies were never prevented from publishing taxation information in general. They could have, had they so wished, adjusted their activities so as to comply with the Personal Data Act.
113. Referring to the margin of appreciation, the Government emphasised, as did the Chamber, that the Court would need strong reasons to substitute its own view for that of the domestic courts. The domestic courts had been acting within the margin of appreciation afforded to them and had struck a fair balance between the competing interests at stake. The interference complained of was “necessary in a democratic society” and there had been no violation of Article 10 of the Convention.
C. Third-party observations
1. The European Information Society Institute
114. The European Information Society Institute noted that data journalism involved the making of already existing information more useful to the public. Processing and analysing of available data on a particular topic was also an important journalistic activity in and of itself. To remove the protection of Article 10 when journalists published databases would jeopardise the protection that ought to be afforded to a wide range of activities in which journalists engaged to impart information to the public. If the use of new technologies could not find protection under Article 10, the right to impart information as well as the right to receive it would be seriously impaired.
115. The traditional criteria for defining the limits on the quantity of information that could be published and processed by private actors were not well suited to balancing the tensions created by data journalism. The balancing factors previously used by the Court were not useful in cases like the present one. When data journalists made available information that was in the public interest, their actions should be supported in a democratic society – not silenced. The European Information Society Institute therefore suggested that the Court might revisit its method of applying the existing case-law in cases where journalists processed information in order to impart information to the public. It should extend the Article 10 protection to innovative forms of journalism and recognise that the standard for determining how Article 10 protected journalists engaged in the processing of data could have important consequences.
2. NORDPLUS Law and Media Network
116. NORDPLUS Law and Media Network noted that it was important for the Court to develop principles related to freedom of expression in the light of present day conditions and to consider how the established principles applied in the digital media context. Many UN, EU and OECD guidelines referred to media neutrality and technological neutrality when addressing the digital media environment. The present case provided a key opportunity to review the existing definition of “journalist”. The EU guidelines pointed out that there was a need to go beyond the notion of traditional journalists and widen its scope for the benefit of those whose freedom of expression should be protected. An extended scope could also have an impact on the balancing test and its possible reassessment. The Court should further elaborate on whether the concept of “chilling effect” should be viewed differently in the new media environment.
117. Access to information was one of the cornerstones of participation in democratic debate and a precondition for the media in the performance of their role of public watchdog. Many countries had different traditions when it came to making information public. In Finland, transparency was a highly important societal value. NORDPLUS Law and Media Network concluded that the Court’s case-law needed further clarification in order to reduce the uncertainty that existed in the field of freedom of expression and the right to privacy in the digital media environment.
3. ARTICLE 19, the Access to Information Programme and Társaság a Szabadságjogokért
118. ARTICLE 19, the Access to Information Programme and Társaság a Szabadságjogokért noted that the CJEU had in 2008 adopted a wide definition of journalism in its case Satakunnan Markkinapörssi. The Committee of Ministers of the Council of Europe had also defined a journalist broadly as “any natural or legal person who [was] regularly or professionally engaged in the collection and dissemination of information to the public via any means of mass communication”. In Ireland, the High Court had extended the journalistic privilege to bloggers, and the UN Special Rapporteur on Freedom of Expression had noted in his 2015 report that persons other than professional journalists carried out a “vital public watchdog role”. The Court should therefore not set the standard of protection under Article 10 any lower than mentioned above.
119. Disclosure of public personal data could contribute to the good of society by creating transparency and accountability around the actions of those who wielded power within society or, conversely, were engaged in unlawful conduct. Publication of such information did not merely satisfy the curiosity of readers but contributed substantially to the pursuit of public interest journalism. These arguments became even stronger if the personal data had previously been published by the State or had otherwise been deemed public under national legislation. The fact that such information was made public implied that there was a public interest regarding access to such information. The public interest in publishing such information outweighed privacy considerations and, once publication had taken place, the information could no longer be regarded as inherently private.
D. The Court’s assessment
1. Preliminary remarks on the scope and context of the Court’s assessment
120. The Court notes at the outset that the present case is unusual to the extent that the taxation data at issue were publicly accessible in Finland. Furthermore, as emphasised by the applicant companies, they were not alone amongst media outlets in Finland in collecting, processing and publishing taxation data such as the data which appeared in Veropörssi. Their publication differed from that of those other media outlets by virtue of the manner and the extent of the data published.
121. In addition, as also indicated in paragraph 81 above, only a very small number of Council of Europe member States provide for public access to taxation data, a fact which raises issues regarding the margin of appreciation which Finland enjoys when providing and regulating public access to such data and reconciling that access with the requirements of data protection rules and the right to freedom of expression of the press.
122. Given this context and the fact that at the heart of the present case lies the question whether the correct balance was struck between that right and the right to privacy as embodied in domestic data protection and access to information legislation, it is necessary, at the outset, to outline some of the general principles deriving from the Court’s case-law on Article 10 and press freedom, on the one hand, and the right to privacy under Article 8 of the Convention in the particular context of data protection on the other.
123. Bearing in mind the need to protect the values underlying the Convention and considering that the rights under Articles 10 and 8 of the Convention deserve equal respect, it is important to remember that the balance to be struck by national authorities between those two rights must seek to retain the essence of both (see also Delfi AS v. Estonia [GC], no. 64569/09, § 110, ECHR 2015).
(a) Article 10 and press freedom
124. The Court has consistently held that freedom of expression constitutes one of the essential foundations of a democratic society and one of the basic conditions for its progress and for each individual’s self-fulfilment. Subject to paragraph 2 of Article 10, it is applicable not only to “information” or “ideas” that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb. Such are the demands of pluralism, tolerance and broadmindedness without which there is no “democratic society”. As enshrined in Article 10, freedom of expression is subject to exceptions which must, however, be construed strictly, and the need for any restrictions must be established convincingly (see Von Hannover v. Germany (no. 2) [GC], nos. 40660/08 and 60641/08, § 101, ECHR 2012; Couderc and Hachette Filipacchi Associés v. France [GC], no. 40454/07, § 88, ECHR 2015 (extracts); and Bédat v. Switzerland [GC], no. 56925/08, § 48, ECHR 2016).
125. Although the press must not overstep certain bounds, regarding in particular protection of the reputation and rights of others, its task is nevertheless to impart – in a manner consistent with its obligations and responsibilities – information and ideas on all matters of public interest. The task of imparting information necessarily includes, however, “duties and responsibilities”, as well as limits which the press must impose on itself spontaneously (see Couderc and Hachette Filipacchi Associés, cited above, § 89; and Von Hannover (no. 2), cited above, § 102).
126. The vital role of the media in facilitating and fostering the public’s right to receive and impart information and ideas has been repeatedly recognised by the Court. Not only does the press have the task of imparting such information and ideas; the public also has a right to receive them. Were it otherwise, the press would be unable to play its vital role as “public watchdog” (see, recently, Magyar Helsinki Bizottság v. Hungary [GC], no. 18030/11, § 165, 8 November 2016, ECHR 2016; and further authorities).
127. Furthermore, the Court has consistently held that it is not for it, any more than it is for the national courts, to substitute its own views for those of the press as to what techniques of reporting should be adopted in a particular case (see Jersild v. Denmark, 23 September 1994, § 31, Series A no. 298; and Stoll v. Switzerland [GC], no. 69698/01, § 146, ECHR 2007‑V).
128. Finally, it is well-established that the gathering of information is an essential preparatory step in journalism and an inherent, protected part of press freedom (see, most recently, Magyar Helsinki Bizottság, cited above, § 130, with further references).
(b) Article 8, the right to privacy and data protection
129. As regards whether, in the circumstances of the present case, the right to privacy under Article 8 of the Convention is engaged given the publicly accessible nature of the taxation data processed and published by the applicant companies, the Court has constantly reiterated that the concept of “private life” is a broad term not susceptible to exhaustive definition (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 66, ECHR 2008; and Vukota-Bojić v. Switzerland, no. 61838/10, § 52, 18 October 2016).
130. Leaving aside the numerous cases in which the Court has held that the right to privacy in Article 8 covers the physical and psychological integrity of a person, private life has also been held to include activities of a professional or business nature (see Niemietz v. Germany, 16 December 1992, § 29, Series A no. 251 B) or the right to live privately, away from unwanted attention (see Smirnova v. Russia, nos. 46133/99 and 48183/99, § 95, ECHR 2003 IX (extracts)).
131. Indeed, the Court has also held that there is a zone of interaction of a person with others, even in a public context, which may fall within the scope of “private life” for the purposes of Article 8 of the Convention (see Couderc and Hachette Filipacchi Associés, cited above, § 83; and P.G. and J.H. v. the United Kingdom, no. 44787/98, § 56, ECHR 2001-IX).
132. The vast majority of cases in which the Court has had to examine the balancing by domestic authorities of press freedom under Article 10 and the right to privacy under Article 8 of the Convention have related to alleged infringements of the right to privacy of a named individual or individuals as a result of the publication of particular material (see, for example, Flinkkilä and Others v. Finland, no. 25576/04, 6 April 2010; and Ristamäki and Korvola v. Finland, no. 66456/09, 29 October 2013).
133. In the particular context of data protection, the Court has, on a number of occasions, referred to the Data Protection Convention (see paragraph 80 above), which itself underpins the Data Protection Directive applied by the domestic courts in the present case. That Convention defines personal data in Article 2 as “any information relating to an identified or identifiable individual”. In Amann, cited above, § 65, the Court provided an interpretation of the notion of “private life” in the context of storage of personal data when discussing the applicability of Article 8:
“The Court reiterates that the storing of data relating to the ‘private life’ of an individual falls within the application of Article 8 § 1 (see the Leander v. Sweden judgment of 26 March 1987, Series A no. 116, p. 22, § 48).
It points out in this connection that the term ‘private life’ must not be interpreted restrictively. In particular, respect for private life comprises the right to establish and develop relationships with other human beings; furthermore, there is no reason of principle to justify excluding activities of a professional or business nature from the notion of ‘private life’ (see the Niemietz v. Germany judgment of 16 December 1992, Series A no. 251-B, pp. 33-34, § 29; and the Halford judgment cited above, pp. 1015-16, § 42).
That broad interpretation corresponds with that of the Council of Europe’s Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data, which came into force on 1 October 1985 and whose purpose is ‘to secure in the territory of each Party for every individual ... respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him’ (Article 1), such personal data being defined as ‘any information relating to an identified or identifiable individual’ (Article 2).”
134. The fact that information is already in the public domain will not necessarily remove the protection of Article 8 of the Convention. Thus, in Von Hannover v. Germany (no. 59320/00, §§ 74-75 and 77, ECHR 2004 VI), concerning the publication of photographs which had been taken in public places of a known person who did not have any official function, the Court found that the interest in publication of that information had to be weighed against privacy considerations, even though the person’s public appearance could be assimilated to “public information”.
135. Similarly, in Magyar Helsinki Bizottság, cited above, §§ 176-178, central to the Court’s dismissal of privacy concerns was not the public nature of the information to which the applicant sought access, which is a factor to be considered in any balancing exercise, but rather the fact that the domestic authorities made no assessment whatsoever of the potential public-interest character of the information sought by the applicant in that case. Those authorities were rather concerned with the status of public defenders in relation to which the information was sought from the perspective of the Hungarian Data Act, which itself allowed for only very limited exceptions to the general rule of non-disclosure of personal data. Moreover, the respondent government in that case failed to demonstrate that the disclosure of the requested information could have affected the right to privacy of those concerned (ibid., § 194).
136. It follows from well-established case-law that where there has been compilation of data on a particular individual, processing or use of personal data or publication of the material concerned in a manner or degree beyond that normally foreseeable, private life considerations arise (see Uzun v. Germany, no. 35623/05, §§ 44-46, ECHR 2010 (extracts); see also Rotaru v. Romania, cited above, §§ 43-44; P.G. and J.H. v. the United Kingdom, cited above, § 57; Amann, cited above, §§ 65-67; and M.N. and Others v. San Marino, no. 28005/12, §§ 52-53, 7 July 2015).
137. The protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life, as guaranteed by Article 8 of the Convention. The domestic law must afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article (see S. and Marper, cited above, § 103). Article 8 of the Convention thus provides for the right to a form of informational self-determination, allowing individuals to rely on their right to privacy as regards data which, albeit neutral, are collected, processed and disseminated collectively and in such a form or manner that their Article 8 rights may be engaged.
138. In the light of the foregoing considerations and the Court’s existing case-law on Article 8 of the Convention, it appears that the data collected, processed and published by the applicant companies in Veropörssi, providing details of the taxable earned and unearned income as well as taxable net assets, clearly concerned the private life of those individuals, notwithstanding the fact that, pursuant to Finnish law, that data could be accessed, in accordance with certain rules, by the public.
2. Existence of an interference
139. The Court notes that, by virtue of the decisions of the domestic data protection authorities and courts, the first applicant company was prohibited from processing taxation data in the manner and to the extent that had been the case in 2002 and from forwarding that information to an SMS service. Those courts found that the collection of personal data and their processing in the background file of the first applicant company could not as such be regarded as contrary to the data protection rules, provided, inter alia, that the data had been protected properly. However, considering the manner and the extent to which the personal data in the background file had subsequently been published in Veropörssi, the first applicant company, which was found not to be able to rely on the journalistic purposes derogation, had processed personal data concerning natural persons in violation of the Personal Data Act. The second applicant company was prohibited from collecting, storing or forwarding to an SMS service any data received from the first applicant company’s database and published in Veropörssi (see paragraph 23 above).
140. The Court finds that the Data Protection Board’s decision, as upheld by the national courts, entailed an interference with the applicant companies’ right to impart information as guaranteed by Article 10 of the Convention.
141. In the light of paragraph 2 of Article 10, such an interference with the applicant companies’ right to freedom of expression must be “prescribed by law”, have one or more legitimate aims and be “necessary in a democratic society”.
3. Lawfulness
142. The expression “prescribed by law” in the second paragraph of Article 10 not only requires that the impugned measure should have a legal basis in domestic law, but also refers to the quality of the law in question, which should be accessible to the person concerned and foreseeable as to its effects (see, amongst many authorities, Delfi AS, cited above, § 120, with further references).
143. As regards the requirement of foreseeability, the Court has repeatedly held that a norm cannot be regarded as a “law” within the meaning of Article 10 § 2 unless it is formulated with sufficient precision to enable a person to regulate his or her conduct. That person must be able – if need be with appropriate advice – to foresee, to a degree that is reasonable in the circumstances, the consequences which a given action may entail. Those consequences need not be foreseeable with absolute certainty. Whilst certainty is desirable, it may bring in its train excessive rigidity, and the law must be able to keep pace with changing circumstances. Accordingly, many laws are inevitably couched in terms which, to a greater or lesser extent, are vague, and whose interpretation and application are questions of practice (see further Delfi AS, cited above, § 121; and Centro Europa 7 S.r.l. and Di Stefano v. Italy [GC], no. 38433/09, § 141, ECHR 2012).
144. The role of adjudication vested in the national courts is precisely to dissipate such interpretational doubts as may remain. The Court’s power to review compliance with domestic law is thus limited, as it is primarily for the national authorities, notably the courts, to interpret and apply domestic law (see, amongst other authorities, Kudrevičius and Others v. Lithuania [GC], no. 37553/05, § 110, ECHR 2015, with further references). Moreover, the level of precision required of domestic legislation – which cannot provide for every eventuality – depends to a considerable degree on the content of the law in question, the field it is designed to cover and the number and status of those to whom it is addressed (see Delfi AS, cited above, § 122; and Kudrevičius, cited above, § 110).
145. The Court has found that persons carrying on a professional activity, who are used to having to proceed with a high degree of caution when pursuing their occupation, can on this account be expected to take special care in assessing the risks that such activity entails (see Delfi AS, cited above, § 122, with further references; and, in the context of banking data, G.S.B. v. Switzerland, no. 28601/11, § 69, 22 December 2015).
146. In the present case, the applicant companies and the Government (see paragraphs 102 and 107 above respectively) differed as to whether the interference with the applicant company’s freedom of expression was “prescribed by law”.
147. As regards the existence of a clear legal basis for the impugned interference, the Court finds no reason to call into question the view taken by the Supreme Administrative Court in the instant case that the impugned interference had a legal basis in sections 2(5), 32 and 44(1) of the Personal Data Act (see paragraph 22 above).
148. As regards the foreseeability of the domestic legislation and its interpretation and application by the domestic courts, in the absence of a provision in the domestic legislation explicitly regulating the quantity of data which could be published and in view of the fact that several media outlets in Finland were also engaged in publication of similar taxation data to some extent, the question arises whether the applicant companies could be considered to have foreseen that their specific publishing activities would fall foul of the existing legislation, bearing in mind in this connection the existence of the journalistic purposes derogation.
149. For the Court, the terms of the relevant data protection legislation and the nature and scope of the journalistic derogation on which the applicant companies sought to rely were sufficiently foreseeable and those provisions were applied in a sufficiently foreseeable manner following the interpretative guidance provided to the Finnish court by the CJEU. The Personal Data Act transposed the Data Protection Directive into Finnish law. According to the Act, the processing of personal data meant the collection, recording, organisation, use, transfer, disclosure, storage, manipulation, combination, protection, deletion and erasure of personal data, as well as other measures directed at personal data (see paragraph 34 above). It seems reasonably clear from this wording and from the relevant preparatory work (see paragraph 36 above) that there was a possibility that the national competent authorities would one day arrive at the conclusion, as they did in this case, that a database established for journalistic purposes could not be disseminated as such. The quantity and form of the data published could not exceed the scope of the derogation and the derogation, by its nature, had to be restrictively interpreted, as the CJEU clearly indicated.
150. Even if the applicant companies’ case was the first of its kind under the Personal Data Act, that would not render the domestic courts’ interpretation and application of the journalistic derogation arbitrary or unpredictable (see Kudrevičius, cited above, § 115; and, mutatis mutandis, in relation to Article 7 of the Convention, Huhtamäki v. Finland, no. 54468/09, § 51, 6 March 2012, with further references), nor would the fact that the Supreme Administrative Court sought guidance from the CJEU on the interpretation of the derogation in Article 9 of the Data Protection Directive. Indeed, as regards the latter, the Court has regularly emphasised the importance, for the protection of fundamental rights in the EU, of the judicial dialogue conducted between the domestic courts of EU Member States and the CJEU in the form of references from the former for preliminary rulings by the latter (see Bosphorus Hava Yolları Turizm ve Ticaret Anonim Şirketi v. Ireland [GC], no. 45036/98, § 164, ECHR 2005‑VI; and Avotiņš v. Latvia [GC], no. 17502/07, §§ 105 and 109, ECHR 2016).
151. Moreover, the applicant companies were media professionals and, as such, they should have been aware of the possibility that the mass collection of data and its wholesale dissemination – pertaining to about one third of Finnish taxpayers or 1.2 million people, a number 10 to 20 times greater than that covered by any other media organisation at the time – might not be considered as processing “solely” for journalistic purposes under the relevant provisions of Finnish and EU law.
152. In the instant case, following their requests for data from the National Board of Taxation in 2000 and 2001, the applicant companies were requested by the Data Protection Ombudsman to provide further information regarding those requests and were told that the data could not be disclosed if Veropörssi continued to be published in its usual form. Instead of complying with the request for more information of the Ombudsman, the applicant companies circumvented the usual route for journalists to access the taxation data sought and organised for the latter to be collected manually at the local tax offices (see paragraph 12 above). It is not for the Court to speculate on the reasons why they acted in this way but the fact that they did suggests some anticipation, on their part, of difficulties in relying on the journalistic purposes derogation and the relevant national legislation on access to taxation data.
153. Furthermore, the 1992 version of the Guidelines for Journalists – reproduced in 2005, 2011 and 2014 – indicated clearly that the principles concerning the protection of an individual also applied to the use of information contained in public documents or other public sources and that the mere fact that information was accessible to the public did not always mean that it was freely publishable. These guidelines, which were intended to ensure self-regulation by Finnish journalists and publishers, must have been familiar to the applicant companies.
154. In light of the above considerations, the Court concludes that the impugned interference with the applicant companies’ right to freedom of expression was “prescribed by law”.
4. Legitimate aim
155. The parties did not in substance dispute that the interference with the applicant companies’ freedom of expression could be regarded as pursuing the legitimate aim of protecting “the reputation and rights of others”.
156. However, the applicant companies argued that while the need to protect against violations of privacy might be a relevant consideration, it was one which the Finnish legislator had already taken into account, assessed and accepted when adopting the Personal Data Act. In their view, the alleged need to protect privacy in the instant case was abstract and hypothetical. Any threat to privacy had been practically non-existent and, in any event, the case was not at all about the privacy of isolated individuals.
157. The Court notes that, contrary to the suggestions of the applicant companies, it emerges clearly from the case file that the Data Protection Ombudsman acted on the basis of concrete complaints from individuals claiming that the publication of taxation data in Veropörssi infringed their right to privacy. As is clear from the figures indicated in paragraph 9 above, a very large group of natural persons who were taxpayers in Finland had been directly targeted by the applicant companies’ publishing practice. It is arguable that all Finnish taxpayers were affected, directly or indirectly, by the applicant companies’ publication since their taxable income could be estimated by readers by virtue of their inclusion in or exclusion from the lists published in Veropörssi.
158. Leaving aside the question whether it would have been necessary to identify individual complainants at national level, the applicant companies’ argument fails to appreciate the nature and scope of the duties of the domestic data protection authorities pursuant to, inter alia, section 44 of the Personal Data Act and the corresponding provisions of the Data Protection Directive. As regards the latter, it is noteworthy that the CJEU has held that the guarantee of the independence of national supervisory authorities was established in order to strengthen the protection of individuals and bodies affected by the decisions of those authorities. In order to guarantee that protection, the national supervisory authorities must, in particular, ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data (see the CJEU judgment in the Schrems case, cited in paragraph 76 above). The protection of privacy was thus at the heart of the data protection legislation for which these authorities were mandated to ensure respect.
159. In the light of the above considerations and taking into account the aims of the Data Protection Convention, reflected in Directive 95/46 and, more recently, in Regulation 2016/79 (see paragraphs 59 and 67 above), it is clear that the interference with the applicant companies’ right to freedom of expression pursued the legitimate aim of protecting “the reputation or rights of others”, within the meaning of Article 10 § 2 of the Convention.
5. Necessary in a democratic society
160. The core question in the instant case, as indicated previously, is whether the interference with the applicant companies’ right to freedom of expression was “necessary in a democratic society” and whether, in answering this question, the domestic courts struck a fair balance between that right and the right to respect for private life.
161. Having outlined above – see paragraphs 120-138 ‒ some general principles relating to the rights to freedom of expression and respect for private life, as well as why Article 8 of the Convention is clearly engaged in circumstances such as these, the Court considers it useful to reiterate the criteria for balancing these two rights in the circumstances of a case such as the present one.
(a) General principles concerning the margin of appreciation and balancing of rights
162. The choice of the means calculated to secure compliance with Article 8 of the Convention is in principle a matter that falls within the Contracting States’ margin of appreciation, whether the obligations on the State are positive or negative (see Couderc and Hachette Filipacchi Associés, cited above, § 90; and Von Hannover (no. 2), cited above, § 104, with further references). Likewise, under Article 10 of the Convention, the Contracting States have a certain margin of appreciation in assessing whether and to what extent an interference with the freedom of expression protected by this provision is necessary (ibid.).
163. In cases which require the right to respect for private life to be balanced against the right to freedom of expression, the Court reiterates that the outcome of the application should not, in principle, vary according to whether it has been lodged with the Court under Article 8 of the Convention by the person who was the subject of the news report, or under Article 10 by the publisher. Indeed, as indicated previously, these rights deserve equal respect (see paragraph 123 above). Accordingly, the margin of appreciation should in principle be the same in both situations.
164. According to the Court’s established case-law, the test of necessity in a democratic society requires the Court to determine whether the interference complained of corresponded to a pressing social need, whether it was proportionate to the legitimate aim pursued and whether the reasons given by the national authorities to justify it are relevant and sufficient (see The Sunday Times v. the United Kingdom (no. 1), 26 April 1979, § 62, Series A no. 30). The margin of appreciation left to the national authorities in assessing whether such a need exists and what measures should be adopted to deal with it is not, however, unlimited but goes hand in hand with European supervision by the Court, whose task it is to give a final ruling on whether a restriction is reconcilable with freedom of expression as protected by Article 10. As indicated above, when exercising its supervisory function, the Court’s task is not to take the place of the national courts but rather to review, in the light of the case as a whole, whether the decisions they have taken pursuant to their power of appreciation are compatible with the provisions of the Convention relied on (see, in particular, the summary of the relevant principles in Perinçek v. Switzerland [GC], no. 27510/08, § 198, ECHR 2015 (extracts); and, in particular, Von Hannover (no. 2), cited above, § 105). Where the balancing exercise has been undertaken by the national authorities in conformity with the criteria laid down in the Court’s case-law, the Court would require strong reasons to substitute its view for that of the domestic courts (see Couderc and Hachette Filipacchi Associés, cited above, § 92; and Von Hannover (no. 2), cited above, § 107).
165. The Court has already had occasion to lay down the relevant principles which must guide its assessment – and, more importantly, that of domestic courts – of necessity. It has thus identified a number of criteria in the context of balancing the competing rights. The relevant criteria have thus far been defined as: contribution to a debate of public interest, the degree of notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, form and consequences of the publication, and, where it arises, the circumstances in which photographs were taken. Where it examines an application lodged under Article 10, the Court will also examine the way in which the information was obtained and its veracity, and the gravity of the penalty imposed on the journalists or publishers (see Couderc and Hachette Filipacchi Associés, cited above, § 93; Von Hannover (no. 2), cited above, §§ 109-13; and Axel Springer AG v. Germany [GC], no. 39954/08, §§ 90-95, 7 February 2012).
166. The Court considers that the criteria thus defined may be transposed to the present case, albeit certain criteria may have more or less relevance given the particular circumstances of the present case which, as explained previously (see paragraphs 8-9 above), concerned the mass collection, processing and publication of data which were publicly accessible in accordance with certain rules and which related to a large number of natural persons in the respondent State.
(b) Application of the relevant general principles to the present case
(i) Contribution of the impugned publication to a debate of public interest
167. There is, as the Court has consistently held, little scope under Article 10 § 2 of the Convention for restrictions on political speech or on debate on matters of public interest (see Sürek v. Turkey (no. 1) [GC], no. 26682/95, § 61, ECHR 1999-IV; and Wingrove v. the United Kingdom, 25 November 1996, § 58, Reports of Judgments and Decisions 1996‑V). The margin of appreciation of States is thus reduced where a debate on a matter of public interest is concerned (see Couderc and Hachette Filipacchi Associés, cited above, § 96, with further references).
168. In ascertaining whether a publication disclosing elements of private life also concerned a question of public interest, the Court has taken into account the importance of the question for the public and the nature of the information disclosed (see Couderc and Hachette Filipacchi Associés, cited above, § 98; and Von Hannover no. 2, cited above, § 109).
169. The public has a right to be informed, and this is an essential right in a democratic society which, in certain special circumstances, can even extend to aspects of the private life of public figures. However, articles aimed solely at satisfying the curiosity of a particular readership regarding the details of a person’s private life, however well-known that person might be, cannot be deemed to contribute to a debate of public interest (see Von Hannover, cited above, § 65; MGN Limited v. the United Kingdom, no. 39401/04, § 143, 18 January 2011; and Alkaya v. Turkey, no. 42811/06, § 35, 9 October 2012).
170. In order to ascertain whether a publication concerning an individual’s private life is not intended purely to satisfy the curiosity of a certain readership, but also relates to a subject of general importance, it is necessary to assess the publication as a whole and have regard to the context in which it appears (see Couderc and Hachette Filipacchi Associés, cited above, § 102; Tønsbergs Blad A.S. and Haukom v. Norway, no. 510/04, § 87, 1 March 2007; Björk Eiðsdóttir v. Iceland, no. 46443/09, § 67, 10 July 2012; and Erla Hlynsdόttir v. Iceland, no. 43380/10, § 64, 10 July 2012).
171. Public interest ordinarily relates to matters which affect the public to such an extent that it may legitimately take an interest in them, which attract its attention or which concern it to a significant degree, especially in that they affect the well-being of citizens or the life of the community. This is also the case with regard to matters which are capable of giving rise to considerable controversy, which concern an important social issue, or which involve a problem that the public would have an interest in being informed about. The public interest cannot be reduced to the public’s thirst for information about the private life of others, or to an audience’s wish for sensationalism or even voyeurism (see Couderc and Hachette Filipacchi Associés, cited above, §§ 101 and 103, and the further references cited therein).
172. It is unquestionable that permitting public access to official documents, including taxation data, is designed to secure the availability of information for the purpose of enabling a debate on matters of public interest. Such access, albeit subject to clear statutory rules and restrictions, has a constitutional basis in Finnish law and has been widely guaranteed for many decades (see paragraphs 37-39 above).
173. Underpinning the Finnish legislative policy of rendering taxation data publicly accessible was the need to ensure that the public could monitor the activities of government authorities. While the applicant companies referred to the fact that access to taxation data also enabled supervision by citizens of one another and the reporting of tax evasion, the Court has not, on the basis of the relevant preparatory works and the material available to it, been able to confirm that this was the objective of the Finnish access regime (see paragraph 43 above) or that, over time, this supervisory purpose developed.
174. Nevertheless, public access to taxation data, subject to clear rules and procedures, and the general transparency of the Finnish taxation system does not mean that the impugned publication itself contributed to a debate of public interest. Taking the publication as a whole and in context and analysing it in the light of the above-mentioned case-law (see paragraphs 162-166 above), the Court, like the Supreme Administrative Court, is not persuaded that publication of taxation data in the manner and to the extent done by the applicant companies contributed to such a debate or indeed that its principal purpose was to do so.
175. The journalistic purposes derogation in section 2(5) of the Personal Data Act is intended to allow journalists to access, collect and process data in order to ensure that they are able to perform their journalistic activities, themselves recognised as essential in a democratic society. This point was clearly made by the Supreme Administrative Court in its decision of 2009 (see paragraph 22 above), where it stated that restricting the processing of taxation data by journalists at the pre-publication or disclosure stage would have been impermissible as in practice it could have meant that a decision was being taken on what material could be published. However, the existence of a public interest in providing access to, and allowing the collection of, large amounts of taxation data did not necessarily or automatically mean that there was also a public interest in disseminating en masse such raw data in unaltered form without any analytical input. It had been made clear in the preparatory work on the domestic legislation (see paragraph 36 above) that databases established for journalistic purposes were not intended to be made available to persons not engaged in journalistic activities, thus underlining that the journalistic privilege in question related to the processing of data for internal purposes. This distinction between the processing of data for journalistic purposes and the dissemination of the raw data to which the journalists were given privileged access is clearly made by the Supreme Administrative Court in its first decision of 2009.
176. Furthermore, reliance on the derogation depended on the processing of the data being carried out “solely” for journalistic purposes. Yet, as the Supreme Administrative Court found, the publication of the taxation data in Veropörssi almost verbatim, as catalogues, albeit split into different parts and sorted by municipality, amounted to the disclosure of the entire background file kept for journalistic purposes and there could be no question, in such circumstances, of an attempt solely to express information, opinions or ideas. While the applicant companies argued that the public disclosure of tax records enabled the public to observe results of tax policy – how differences between income and wealth develop, for example, between regions, professions and on the basis of gender – they did not explain how their readers would be able to engage in this type of analysis on the basis of the raw data, published en masse, in Veropörssi.
177. Finally, while the information might have enabled curious members of the public to categorise named individuals, who are not public figures, according to their economic status, this could be regarded as a manifestation of the public’s thirst for information about the private life of others and, as such, a form of sensationalism, even voyeurism (see Couderc and Hachette Filipacchi Associés, cited above, § 101).
178. In the light of these considerations, the Court cannot but agree with the Supreme Administrative Court that the sole object of the impugned publication was not, as required by domestic and EU law, the disclosure to the public of information, opinions and ideas, a conclusion borne out by the layout of the publication, its form, content and the extent of the data disclosed. Furthermore, it does not find that the impugned publication could be regarded as contributing to a debate of public interest or assimilated to the kind of speech, namely political speech, which traditionally enjoys a privileged position in its case-law, thus calling for strict Convention scrutiny and allowing little scope under Article 10 § 2 of the Convention for restrictions (see, in this regard, Sürek v. Turkey (no. 1), cited above, § 61; and Wingrove, cited above, § 58).
(ii) Subject of the impugned publication and how well-known were the persons concerned
179. The data published in Veropörssi comprised the surnames and names of natural persons whose annual taxable income exceeded certain thresholds (see paragraph 9 above). The data also comprised the amount, to the nearest EUR 100, of their earned and unearned income as well as details relating to their taxable net assets. When published in the newspaper, the data were set out in the form of an alphabetical list and were organised according to municipality and income bracket.
180. In the present case, 1.2 million natural persons were the subject of the Veropörssi publication. They were all taxpayers but only some, indeed very few, were individuals with a high net income, public figures or well-known personalities within the meaning of the Court’s case-law. The majority of the persons whose data were listed in the newspaper belonged to low income groups. It was estimated that the data covered one third of the Finnish population and the majority of all full-time workers. Unlike other Finnish publications, the information published by the applicant companies did not pertain specifically to any particular category of persons such as politicians, public officials, public figures or others who belonged to the public sphere by dint of their activities or high earnings (see, in that regard, Krone Verlag GmbH & Co. KG v. Austria, no. 34315/96, § 37, 26 February 2002; and News Verlags GmbH & Co.KG v. Austria, no. 31457/96, § 54, ECHR 2000‑I) or their position (see Verlagsgruppe News GmbH v. Austria (no. 2), no. 10520/02, § 36, 14 December 2006). As the Court has previously stated, such persons inevitably and knowingly lay themselves open to close scrutiny by both journalists and the public at large (see, inter alia, Lingens v. Austria, 8 July 1986, § 42, Series A no. 103 and Couderc and Hachette Filipacchi Associés, cited above, §§ 120-121).
181. The applicant companies rely on the relative anonymity of the natural persons whose names and data featured in the newspaper and were accessible via the SMS service, as well as the sheer amount of data published, to downplay any interference with their privacy rights, suggesting that the more they published the less they interfered with privacy given what they described as a “blending in” factor (see paragraph 103 above). However, even assuming that such a factor could operate to attenuate or diminish the degree of interference resulting from the impugned publication, it fails to take into account the personal nature of the data and the fact that it was provided to the competent tax authorities for one purpose but accessed by the applicant companies for another. It also ignores the fact that the manner and extent of the publication meant that, in one way or another, the resulting publication extended to the entire adult population, uncovered as beneficiaries of a certain income if included in the list but also of not being in receipt of such an income if excluded because of the threshold salaries involved (see also paragraph 157 above). It is the mass collection, processing and dissemination of data which data protection legislation such as that at issue before the domestic courts is intended to address.
(iii) Manner of obtaining the information and its veracity
182. The accuracy of the information published was never in dispute in the present case. The published information was collected in the local tax offices and was accurate.
183. As to the manner in which the information was obtained, it is important to remember that, in the area of press freedom the Court has held that, by reason of the duties and responsibilities inherent in the exercise of the freedom of expression, the safeguard afforded by Article 10 to journalists in relation to reporting on issues of public interest is subject to the proviso that they are acting in good faith in order to provide accurate and reliable information in accordance with the ethics of journalism (see Magyar Helsinki Bizottság, cited above, § 159, with further references).
184. The Court reiterates that, in the present case, the applicant companies cancelled their request for data from the National Board of Taxation and instead hired people to collect taxation data manually at the local tax offices (see paragraph 12 above). They thereby circumvented both the legal limitations (the obligation to substantiate that the data would be collected for a journalistic purpose and not be published as a list) and the practical limitations (by employing people to collect the information manually in order to gain unlimited access to the personal taxation data with a view to its subsequent dissemination) imposed by the relevant domestic legislation. The data were then published in raw form, as catalogues or lists.
185. While the Court cannot but agree with the Chamber judgment that the data were not obtained by illicit means, it is clear that the applicant companies had a policy of circumventing the normal channels open to journalists to access taxation data and, accordingly, the checks and balances established by the domestic authorities to regulate access and dissemination.
(iv) Content, form and consequences of the publication and related considerations
186. The Court has held, as indicated previously (see paragraph 127 above), that the approach to covering a given subject is a matter of journalistic freedom. It is for neither the Court nor the domestic courts, to substitute their own views for those of the press in this area (see Jersild, cited above, § 31; and Couderc and Hachette Filipacchi Associés, cited above, § 139). Article 10 of the Convention also leaves it to journalists to decide what details ought to be published in order to ensure an article’s credibility (see Fressoz and Roire, cited above, § 54; and ibid.). In addition, journalists enjoy the freedom to choose, from the news items that come to their attention, which they will deal with and how. This freedom, however, is not devoid of responsibilities (ibid.). The choices that they make in this regard must be based on their profession’s ethical rules and codes of conduct (see Couderc and Hachette Filipacchi Associés, cited above, § 138).
187. Where the impugned information was already publicly available, the Court has had regard to this factor in its assessment of whether the impugned restriction on freedom of speech was “necessary” for the purposes of Article 10 § 2. In some cases it has been a decisive consideration leading the Court to find a violation of the Article 10 guarantee (see Weber v. Switzerland, 22 May 1990, §§ 48-52, Series A no. 177; Observer and Guardian v. the United Kingdom, 26 November 1991, §§ 66-71, Series A no. 216; The Sunday Times v. the United Kingdom (no. 2), 26 November 1991, §§ 52-56, Series A no. 217; and Vereniging Weekblad Bluf! v. the Netherlands, 9 February 1995, §§ 41-46, Series A no. 306-A) while in others, notably regarding the freedom of the press to report on public court proceedings, the fact that the information was in the public domain was found to be outweighed by the need to protect the right to respect for private life under Article 8 of the Convention (see Egeland and Hanseid v. Norway, no. 34438/04, §§ 62-63, 16 April 2009; and Shabanov and Tren v. Russia, no. 5433/02, §§ 44-50, 14 December 2006).
188. It is noteworthy that the CJEU has made clear – not least in Satakunnan Markkinapörssi Oy, cited above, § 48; and Google Spain, cited above, § 30 – that the public character of data processed does not exclude such data from the scope of the Data Protection Directive and the guarantees the latter lays down for the protection of privacy (see paragraphs 20 and 75 above).
189. Whilst the taxation data in question were publicly accessible in Finland, they could only be consulted at the local tax offices and consultation was subject to clear conditions. The copying of that information on memory sticks was prohibited. Journalists could receive taxation data in digital format, but retrieval conditions also existed and only a certain amount of data could be retrieved. Journalists had to specify that the information was requested for journalistic purposes and that it would not be published in the form of a list (see paragraphs 49-51 above). Therefore, while the information relating to individuals was publicly accessible, specific rules and safeguards governed its accessibility.
190. The fact that the data in question were accessible to the public under the domestic law did not necessarily mean that they could be published to an unlimited extent (see paragraphs 48 and 54 above). Publishing the data in a newspaper, and further disseminating that data via an SMS service, rendered it accessible in a manner and to an extent not intended by the legislator.
191. As indicated previously, the gathering of information is an essential preparatory step in journalism and an inherent, protected part of press freedom (see paragraph 128 above). It is noteworthy that, in the instant case, the Supreme Administrative Court did not seek to interfere with the collection by the applicant companies of raw data, an activity which goes to the heart of press freedom, but rather with the dissemination of data in the manner and to the extent outlined above.
192. It is also necessary, at this point, to reiterate that Finland is one of very few Council of Europe Member States which provides for this degree of public access to taxation data. When assessing the margin of appreciation in a case such as this, as well as the proportionality of the impugned interference and the Finnish regime pursuant to which it was adopted, the Court must also assess the legislative choices which lay behind it and, in that context, the quality of the parliamentary and judicial review of the necessity of that legislation and the measures adopted on that basis which interfere with freedom of expression (see, in this regard, Animal Defenders International v. the United Kingdom [GC], no. 48876/08, §§ 108 and 110, ECHR 2013 (extracts)).
193. As both parties have demonstrated, parliamentary review of Finnish legislation relating to access to information and taxation data in particular, as well as that relating to data protection, has been both exacting and pertinent. That scrutiny and debate at domestic level was furthermore reflected in the data protection context at EU level, when it came to the adoption of the Data Protection Directive and, subsequently, of Regulation 2016/79.
194. The Court observes that the Finnish legislator had decided, in adopting the Act on the Public Disclosure and Confidentiality of Tax Information, to maintain the public accessibility of the taxation data in question. Although a balancing exercise between the private and public interests involved had thus been conducted when this issue was decided by the Finnish Parliament, it does not follow that the treatment of such taxation data would no longer be subject to any data protection considerations as the applicant companies contend. Section 2(5) of the Personal Data Act was adopted to reconcile the rights to privacy and freedom of expression and to accommodate the role of the press but reliance on this journalistic derogation was, as the Supreme Administrative Court indicated, dependent on the fulfilment of certain conditions. The Public Disclosure and Confidentiality of Tax Information also clearly stated that such information “is public to the extent provided in this Act” (see paragraph 39 above).
195. The Court emphasises that the safeguards in national law were built in precisely because of the public accessibility of personal taxation data, the nature and purpose of data protection legislation and the accompanying journalistic derogation. Under these circumstances, and in line with the approach set out in Animal Defenders International (cited above, § 108), the authorities of the respondent State enjoyed a wide margin of appreciation in deciding how to strike a fair balance between the respective rights under Articles 8 and 10 of the Convention in this case. Furthermore, while the margin of appreciation of any State must be limited and its exercise is subject to external supervision by the Court, the latter may also take into consideration, when assessing the overall balance struck, the fact that that State, somewhat exceptionally, as a matter of constitutional choice and, in the interests of transparency, has chosen to make taxation data accessible to the public.
196. In the instant case, the domestic courts, when weighing these rights, sought to strike a balance between freedom of expression and the right to privacy embodied in data protection legislation. Applying the derogation in section 2(5) of the Personal Data Act and the public interest test to the impugned interference, they and, in particular, the Supreme Administrative Court, analysed the relevant Convention and CJEU case-law and carefully applied the case-law of the Court to the facts of the instant case.
(v) Gravity of the sanction imposed on the journalists or publishers
197. As indicated in the Chamber judgment, the applicant companies were not prohibited from publishing taxation data or from continuing to publish Veropörssi, albeit they had to do so in a manner consistent with Finnish and EU rules on data protection and access to information. The fact that, in practice, the limitations imposed on the quantity of the information to be published may have rendered some of their business activities less profitable is not, as such, a sanction within the meaning of the case-law of the Court.
(vi) Conclusion
198. In the light of the aforementioned considerations, the Court considers that, in assessing the circumstances submitted for their appreciation, the competent domestic authorities and, in particular, the Supreme Administrative Court gave due consideration to the principles and criteria as laid down by the Court’s case-law for balancing the right to respect for private life and the right to freedom of expression. In so doing, the Supreme Administrative Court attached particular weight to its finding that the publication of the taxation data in the manner and to the extent described did not contribute to a debate of public interest and that the applicants could not in substance claim that it had been done solely for a journalistic purpose within the meaning of domestic and EU law. The Court discerns no strong reasons which would require it to substitute its view for that of the domestic courts and to set aside the balancing done by them (see Von Hannover (no. 2), cited above, § 107; and Perinçek, cited above, § 198). It is satisfied that the reasons relied upon were both relevant and sufficient to show that the interference complained of was “necessary in a democratic society” and that the authorities of the respondent State acted within their margin of appreciation in striking a fair balance between the competing interests at stake.
199. The Court therefore concludes that there has been no violation of Article 10 of the Convention.
III. ALLEGED VIOLATION OF ARTICLE 6 § 1 OF THE CONVENTION
200. The applicant companies complained under Article 6 § 1 of the Convention about the length of the proceedings before the domestic courts.
The relevant parts of Article 6 § 1 of the Convention read as follows:
“In the determination of his civil rights and obligations ... everyone is entitled to a ... hearing within a reasonable time by [a] ... tribunal ...”
A. The Chamber judgment
201. The Chamber noted that the impugned proceedings before the domestic authorities and courts had lasted over six years and six months at two levels of jurisdiction, of which both levels twice. There had not been any particularly long period of inactivity on the part of the authorities and domestic courts. Even though the case had been of some complexity, it could not be said that this in itself had justified the entire length of the proceedings. According to the Chamber, the excessive total length of the proceedings could be attributed essentially to the fact that the case had been examined twice by each level of jurisdiction.
B. The parties’ submissions
1. The applicant companies
202. The applicant companies submitted that the legal proceedings in the present case had lasted eight years at three levels of jurisdiction, each jurisdiction examining the case twice. It would have been within the power of the Supreme Administrative Court to issue the order of prohibition in its first decision in 2009, without referring the case back to the Data Protection Board. This could have been done in the name of procedural economy and with due regard for the applicant companies’ right to a fair trial within a reasonable time. The length of the proceedings had thus violated the applicant companies’ right guaranteed by Article 6 § 1 of the Convention.
2. The Government
203. The Government disagreed with the Chamber’s findings. They considered that, excluding the time taken for the preliminary reference to the CJEU, the first set of proceedings had lasted three years and three and a half months and the second some two years and three months. The total length had therefore been five years and seven months, from which six months should be deducted as it related to the preparation at national level of that preliminary reference. The overall length was thus five years and seven days.
204. The Government noted that none of the procedural stages had lasted very long. The case had involved two separate sets of proceedings as the subject-matter of the two sets of proceedings was not the same, in spite of the fact that the proceedings related to the same parties and the same facts. The first set of proceedings had concerned the issue of whether the applicant companies had processed personal data in conflict with the provisions of the Personal Data Act. The Supreme Administrative Court had quashed the appealed decision and referred the matter back to the Data Protection Board, which had to conduct a new administrative consideration of the matter and to make a new administrative decision. The second set of proceedings had concerned the question of whether the Data Protection Board’s new decision of 26 November 2009 had corresponded to the previous Supreme Administrative Court’s decision.
205. The Government noted that the matter was exceptionally complex from a legal point of view. In addition to the normal preparation of the case, it also included the drafting of the request to the CJEU for a preliminary ruling, the related interlocutory decision and two hearings. The present case was the first of its kind where the freedom to impart taxation information and data protection concerns were dealt with by the national authorities. No prior domestic case-law existed on this subject.
206. Furthermore, the applicant companies’ conduct had prolonged the second set of proceedings by one and a half months, a delay which could not be attributed to the Government.
207. The Government concluded that in view of the particular circumstances of the case, the proceedings had been conducted within a reasonable time within the meaning of Article 6 § 1 of the Convention.
C. The Court’s assessment
208. The Court notes that the period to be taken into consideration began on 12 February 2004 when the Data Protection Board’s first decision was appealed against, and ended on 18 June 2012 when the Supreme Administrative Court gave a final decision in the case. The case was pending before the CJEU for a preliminary ruling for one year and ten months which time, according to the Court’s case-law, is to be excluded from the length attributable to the domestic authorities (see Pafitis and Others v. Greece, 26 February 1998, § 95, Reports 1998‑I; and Koua Poirrez v. France, no. 40892/98, § 61, ECHR 2003‑X). Deducting this period from the overall duration, the impugned proceedings before the domestic authorities and courts lasted over six years and six months, twice at two different levels of jurisdiction.
209. The reasonableness of the length of proceedings must be assessed, in accordance with well-established case-law, in the light of the circumstances of the case and with reference to the following criteria: the complexity of the case, the conduct of the applicants and the relevant authorities and what was at stake for the applicants in the dispute (see, among many other authorities, Frydlender v. France [GC], no. 30979/96, § 43, ECHR 2000-VII; and Lupeni Greek Catholic Parish and Others v. Romania [GC], no. 76943/11, § 143, ECHR 2016 (extracts)).
210. The Court agrees with the Government that the proceedings were not characterised by any particularly long period of inactivity on the part of the domestic authorities and courts. The proceedings were pending before the domestic authorities and courts for approximately one and a half years for each stage, which cannot be considered excessive as such.
211. The total length of the proceedings is nonetheless excessive, which seems to have been caused by the fact that the case was examined twice by each level of jurisdiction. The Court considers that even if one were to accept the Government’s argument that the applicant companies’ conduct had prolonged the second set of proceedings by one-and-a-half months and that this period ought to be deducted from the overall length, the total length of the proceedings would still be excessive.
212. The Court is of the view that the case was indeed legally complex, a fact demonstrated by a paucity of jurisprudence at Finnish level, the need to refer questions relating to the interpretation of EU law to the CJEU and the very fact that the case was referred to the Grand Chamber of this Court. However, it cannot be said that the legal complexity of the case in itself justified the entire length of the proceedings. Some of this complexity was, in addition, caused by the fact that the case was referred back to the Data Protection Board for a new examination.
213. As regards what was at stake for the applicant companies, it is uncontested that the impugned national decisions had consequences for both the extent to which and the form in which the applicant companies could publish the taxation data and therefore continue their publishing activities unchanged.
214. Having examined all the material submitted to it, the Court considers that, even taking into account the complexity of the case from a legal point of view, the length of the proceedings as a whole was excessive and failed to meet the reasonable time requirement.
215. There has therefore been a breach of Article 6 § 1 of the Convention on account of the length of the proceedings.
IV. APPLICATION OF ARTICLE 41 OF THE CONVENTION
216. Article 41 of the Convention provides:
“If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”
A. Damage
217. The applicant companies claimed EUR 900,000 in respect of pecuniary damage, corresponding to a net loss of income for three years. They did not specify their claim for pecuniary damage further with reference to the two Articles of the Convention which they alleged had been violated.
218. The Government agreed with the Chamber that no causal link had been established between the damage claimed and the alleged violation of Article 6 § 1 of the Convention. Nor had any causal link been established between the damage claimed and the alleged violation of Article 10 of the Convention. According to the Government, no compensation should thus be awarded under this head. Were the Court to consider that pecuniary damage was due, the application of Article 41 of the Convention should be reserved.
219. The Court does not discern, on the basis of the material submitted to it, any causal link between the violation found under Article 6 of the Convention and the pecuniary damage alleged by the applicant companies. The Court therefore rejects this claim. As to the non-pecuniary damage, the Court notes that the applicant companies have made no claim under that head.
B. Costs and expenses
220. The applicant companies claimed EUR 58,050 in respect of costs and expenses incurred both before the domestic courts and the Court.
221. The Government noted that the Chamber had awarded the applicant companies EUR 9,500 (inclusive of value-added tax) to cover the costs claimed at both levels. In the Government’s view this sum was reasonable and should not be increased.
222. According to the Court’s case-law, an applicant is entitled to the reimbursement of costs and expenses only in so far as it has been shown that these have been actually and necessarily incurred and are reasonable as to quantum. In the present case, no documentary evidence supporting the claim for legal fees before the Grand Chamber has been submitted to the Court, as required by Rule 60 § 2 of the Rules of Court. The additional claim for costs and expenses incurred in the proceedings before the Grand Chamber must thus be rejected. Regard being had to the documentary proof provided by the applicant companies in support of their claim at the Chamber level and the above criteria, the Court considers it reasonable to award the sum of EUR 9,500 (inclusive of value-added tax) covering costs incurred before the domestic courts and the Chamber.
C. Default interest
223. The Court considers it appropriate that the default interest rate should be based on the marginal lending rate of the European Central Bank, to which should be added three percentage points.
FOR THESE REASONS, THE COURT
1. Dismisses, unanimously, the Government’s preliminary objections;
2. Holds, by fifteen votes to two, that there has been no violation of Article 10 of the Convention;
3. Holds, by fifteen votes to two, that there has been a violation of Article 6 § 1 of the Convention;
4. Holds, by fourteen votes to three,
(a) that the respondent State is to pay the applicant companies, within three months, EUR 9,500 (nine thousand five hundred euros), inclusive of any tax that may be chargeable, in respect of costs and expenses;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points;
5. Dismisses, by fifteen votes to two, the remainder of the applicant companies’ claim for just satisfaction.
Done in English and in French, and delivered at a public hearing in the Human Rights Building, Strasbourg, on 27 June 2017.
Lawrence Early András Sajó
Jurisconsult President
In accordance with Article 45 § 2 of the Convention and Rule 74 § 2 of the Rules of Court, the following separate opinions are annexed to this judgment:
(a) partly dissenting opinion of Judges Nussberger and López-Guerra;
(b) dissenting opinion of Judges Sajó and Karakaş.
A.S.
T.L.E.
PARTLY DISSENTING OPINION OF JUDGES NUSSBERGER AND LÓPEZ-GUERRA
1. The thrust of this important case is balancing data protection rights and freedom of expression. We fully agree with the majority’s position.
2. Nevertheless, we have to mark our dissent concerning a secondary question. We cannot agree that there has been a violation of Article 6 § 1 of the Convention on account of the length of proceedings.
3. It is true that the proceedings as a whole lasted for over six years and six months at two levels of jurisdiction (see paragraph 208 of the judgment), but it is important to note that four separate courts dealt with the case, each time allowing for a fresh consideration of the legal issues. First it was the Helsinki Administrative Court which decided on the Data Protection Ombudsman’s appeal against the Data Protection Board’s decision not to prohibit the applicant companies from processing the taxation data in the manner and to the extent that had been the case in 2002 and from passing those data to the SMS service. The Supreme Administrative Court had then to decide as second and last instance. After the preliminary ruling of the European Court of Justice the case was referred back to the Board, i.e. to the administrative level, in order to issue the respective prohibition. It was then the applicant companies who – knowing that the legal question had already been decided by two courts – appealed against the Board’s decision. The Turku Administrative Court, and thus a different court, rejected the applicants’ appeal. The applicants still did not accept this judgment and once more brought the case to the Supreme Administrative Court, obviously without any prospect of success.
4. The two sets of proceedings were therefore differently configured. The first set of proceedings was based on the Ombudsman’s appeal against the Board’s refusal to prohibit the applicants’ activity, while the second was based on the applicants’ appeal against the opposite decision. At first the controversy concerned the authorities’ inactivity, but then the second set of proceedings concerned the authorities’ activity.
5. It is important to note that the second set of proceedings was initiated by the applicants only. They used a legal remedy at their disposal which is perfectly legitimate. According to the Court’s long-standing case-law, however, while applicants cannot be blamed for making full use of the remedies available to them under domestic law, this has to be considered as an objective fact which cannot be attributed to the respondent State and which must be taken into account for the purpose of determining whether or not the reasonable time referred to in Article 6 § 1 has been exceeded (see Erkner and Hofauer v. Austria, no. 9616/81, § 68, 23 April 1987; Girardi v. Austria, no. 50064/99, § 56, 11 December 2003; Sociedade de Construções Martins & Vieira, Lda. and Others v. Portugal, no. 56637/10 and 5 others, § 48, 30 October 2014; O’Neill and Lauchlan v. the United Kingdom, nos. 41516/10 and 75702/13, § 92, 28 June 2016).
6. It is true that the Supreme Court could have decided by itself. That would have made it impossible for the applicants to appeal once more; it would have reduced the scope of their legal remedies. It is somehow contradictory for the applicants to complain about having been offered a possibility to appeal and then using it. This procedural strategy was the applicants’ free choice. It was not imposed on them.
7. Furthermore, regard must be had to the legal complexity of the case, highlighted not least by the fact that the proceedings before the European Court of Human Rights have also taken almost five years.
8. Last but not least, there was no particularly long period of inactivity on the part of the authorities and the domestic courts.
9. Therefore, in our view, according to the Court’s well-established criteria in length of proceedings cases, there is no basis for finding a violation of Article 6 § 1 of the Convention in the present case.
DISSENTING OPINION OF JUDGES SAJÓ AND KARAKAŞ
1. This Court has long held that the media – which plays a pre-eminent role as a “public watchdog” – is entitled to robust protections of its right to freedom of expression. However, today’s judgment sees fit to weaken these protections by implausibly declaring that a newspaper publishing a dataset of publicly available information is not engaged in “journalistic activity”, and defending the particularly severe measure of censorship of that newspaper, which has now gone bankrupt.
2. We do not believe that domestic courts should be in the business of passing judgment on what counts as “journalistic activity”. We find unconvincing the Court’s assessment that taxpayer information – the subject of several laws in Finland – is not a matter of genuine “public interest”. We do not believe that the margin of appreciation has been correctly applied in this case, nor that the conflicting rights of the applicants’ freedom of expression and Finnish taxpayers’ individual privacy have been correctly balanced.
3. We therefore respectfully dissent from the Court’s opinion.
A. Journalistic activity and contribution to a legitimate public interest
4. It is not in dispute that there has been an interference with the applicants’ freedom of expression (§ 140 of the judgment). We part company with the majority, however, over the lawfulness of that interference.
5. Under Finnish law, information on the taxable income and assets of taxpayers is public.[1] In 2002 the applicant companies published a certain amount of such information. In April 2003 the Data Protection Ombudsman, invoking taxpayers’ privacy interests, requested that the Data Protection Board restrain the applicant companies from publishing the taxation data. The request was dismissed on the grounds that the applicant companies were engaged in journalism and so were entitled to a derogation from restrictions provided by law on data processing.[2] In February 2007 the Supreme Administrative Court, examining the case, sought a preliminary ruling from the Court of Justice of the European Union (CJEU) on the interpretation of the EU Data Protection Directive[3], which also governed the impugned data processing. In December 2008 the CJEU ruled that activities related to data processing from documents in the public domain could be classified as “journalistic activities” if their object was to disclose to the public information, opinions or ideas, irrespective of the medium used to transmit them. In September 2009 the Supreme Administrative Court concluded that the publication of the whole database could not be regarded as journalistic activity, and directed the Data Protection Board to forbid the applicant companies from publishing such data.
6. Under the Personal Data Act, personal data may be processed without individual consent only under a strictly limited set of conditions, including the performance of contracts, the protection of an individual’s vital interests, or where the Data Protection Board has permitted processing in light of “an important public interest”, as well as a select few others (section 8). A would-be data processor is not subject to these limitations, however, provided they are engaged in “journalism or artistic or literary expression” (section 2(5)). Similarly, the EU Data Protection Directive limits the purposes for which data may be processed, while mandating that “Member States shall provide for exemptions” to these limitations “for the processing of personal data carried out solely for journalistic purposes” (Article 9). The question, therefore, of whether applicants are performing a “journalistic activity” is of central importance, as in the affirmative, the means employed to obtain and the use made of such data are irrelevant.
7. This Court, purporting to rely on the opinion of the Finnish Supreme Administrative Court, claims that “the publication of the taxation data in Veropörssi almost verbatim [...] amounted to the disclosure of the entire background file kept for journalistic purposes and there could be no question, in such circumstances, of an attempt to solely to express information, opinions or ideas” (§ 176 of the judgment, emphasis added). Illogical on the face of it – can we straight-facedly claim that the publication of data is not an attempt to “express information”? – this conclusion is also inconsistent with our case-law, which has never held that a registered journalistic enterprise that publishes data in its newspaper is not engaging in “journalistic activity”. It is also inconsistent with the Court’s own description of the applicants as “media professionals” (§ 151 of the judgment).
8. Today’s judgment makes much of the fact that the applicants published “raw [tax] data in unaltered form without any analytical input” (§ 175 of the judgment), but our Court has never required a journalist to engage in “analytical input” in order to be considered to be performing their duties in imparting information to the public. Nor, as our case-law has long insisted, is it the place of this Court – or the national courts, for that matter –to substitute its own views for those of the press as to what technique of reporting should be adopted (see Axel Springer AG v. Germany [GC], no. 39954/08, § 81, 7 February 2012; Jersild v. Denmark, § 31, 23 September 1994, Series A no. 298). Provided that they are acting in good faith (see Section D below) and on an accurate factual basis in accordance with the ethics of journalism, Article 10 leaves it for journalists to decide whether or not to divulge information on issues of general interest (see Fressoz and Roire v. France [GC], no. 29183/95, § 54, ECHR 1999‑I). Journalism is first and foremost the collection and presentation of facts and not “analytical” input.[4] Fact takes precedence over opinion.
9. The Court attempts to further dilute the importance of the applicants’ speech claims by arguing that the “impugned publication” cannot be regarded as either contributing to a debate of public interest or as a form of political speech, which enjoys a privileged position in the case-law of this Court (see § 178 of the judgment). We find this reasoning strained, for the obvious reason that Finnish legislative policy has seen fit to render taxation data publicly accessible. This is all the more salient given, as the majority notes, that in so doing Finland is part of a small minority of Convention States, thus placing all the greater weight on the public interest in publicity and transparency concerning taxation data (see §§ 81, 120-121 of the judgment).
10. The majority claims that “the existence of a public interest in providing access to, and allowing the collection of, large amounts of taxation data did not necessarily or automatically mean that there was also a public interest in disseminating en masse such raw data” (see § 175 of the judgment).[5] Is this to say that what is available to the public is nevertheless unsuitable for publication? Dissemination of information is one of the usual purposes of maintaining a publicly accessible data collection.[6] Further, the Court has decided that the publication of a “certain” quantity of data does not enjoy the protection of the law, although the law nowhere specifies any threshold of this sort. The very fact that Finnish law made such data publicly available proves that its dissemination was not only lawful but also a matter of serious public interest in the Finnish context. In fact, the Act on the Public Disclosure and Confidentiality of Tax Information, which makes such data public, stipulates that its provisions should take precedence over the Act on the Openness of Government Activities and the Personal Data Act (section 2; see also § 15 of the applicants’ 23 April 2014 submissions and § 26 of their 17 March 2016 submissions).
11. The majority attempts, further, to claim that because the data was published “en masse” and in “raw” form, its sheer size would render the public unable to engage in the business of observing and monitoring Government activities (see § 176 of the judgment). The Court adds that the information might enable curious members of society to satisfy a sensationalist or even voyeuristic thirst for information on the private lives of others (see § 177 of the judgment). Therefore, the Court concludes, the “sole object” of the publication could not have been the disclosure to the public of important information (see § 178 of the judgment).
12. However, the Court fails to consider that a larger quantity of data does contribute to public interest since it promotes fiscal transparency (which is why the law was passed in the first place). Furthermore, whether or not the data can be used for voyeuristic purposes does not undermine (let alone preclude) the public interest of the published information. The publication of more information cannot automatically mean that the information is of lesser value, has less public interest, is voyeuristic, or is prone to sensationalism (see, by converse implication, Von Hannover v. Germany, no. 59320/00, § 65, ECHR 2004‑VI). The impugned publication is not one concerning intimate aspects of private life which is typically the object of voyeurism, a term never defined by the majority.[7]
B. The lawfulness of the ban on publication
13. Since we cannot agree with the Court that the impugned publication was not “journalistic”, we must conclude that the Data Protection Board’s order to retrospectively prohibit the applicants from publishing tax data in the manner sought was unforeseeable and therefore not prescribed by law (§§ 13, 34 of the judgment).
14. The Act on the Public Disclosure and Confidentiality of Tax Information provides that taxation data, including a taxpayer’s name, year of birth and municipality of domicile is public (section 5). It specifies, further, that the Personal Data Act does not restrict the collection of data for journalistic purposes (section 16(3)). As already mentioned, under the Personal Data Act, journalists are subject to a less stringent set of restrictions when processing personal data than is the rest of the population.[8] In the case of tax data, the obligation to protect must be understood in the context of a statutory framework that makes these data public.
15. In the light of those Acts, the request by the Data Protection Ombudsman in 2003 and the resulting judgment of the Supreme Administrative Court in 2007 (!) to cease publication was unforeseeable and arbitrary. Notably, the order objected, not to the publication of the data per se, but to the length and format in which those data were published, a criterion the applicants could not reasonably have foreseen. More importantly, given the journalistic exemption contained in both the Public Disclosure Act and the Data Protection Act, it was eminently reasonable that the applicants would have believed their publication to be protected. The confusion witnessed at multiple levels of judicial reviewing bodies over whether the journalistic exemption applies in the case also supports that point (see, inter alia, §§ 15, 17, 19, 20, 23 of the judgment).
16. The Court has repeatedly held, as the majority notes, that a norm cannot be regarded as a “law” within the meaning of Article 10 § 2 unless it is formulated with sufficient precision to allow a person to regulate his or her conduct (§ 143 of the judgment). In the present case, the notion that the applicants, two media companies, would have foreseen that they would not be protected by the journalistic exemption is highly implausible (see § 143 of the judgment) in view of the text of the applicable law and also taking into consideration the understanding of journalism by this Court. Furthermore, two prior applications of the Personal Data Act had held, respectively, that public taxation data could be provided to media in mass deliveries in electronic format, and that a media organisation that had published data on a group of 10,000 people considered to be the wealthiest people in Finland had processed data for journalistic purposes (see § 38 of the judgment).[9]
17. In the light of the foregoing considerations, we must conclude that the interference was not foreseeable, and therefore not one prescribed by law.
C. Margin of appreciation
18. As to the margin of appreciation to be afforded in the present case, we believe that the authorities of the respondent State did not act within that margin in striking a fair balance between the competing interests at stake.
19. To begin with, this case presumes that the Finnish Parliament acted within its margin of appreciation when providing such a degree of public access to taxation data (regardless of the fact that Finland is one of the very few members of the Council of Europe that does so). This Court has previously attached great importance to the quality of parliamentary review of the necessity of legislation restricting rights (see Animal Defenders International v. the United Kingdom [GC], no. 48876/08, §§ 108 and 110, ECHR 2013 (extracts)).[10] In this case, the majority considers the parliamentary review conducted by the Finnish Parliament to be “exacting and pertinent” (§ 193 of the judgment). However, it is contradictory to grant a wide margin of appreciation to the Finnish authorities to pass a law because of its democratic legitimacy while also granting that margin of appreciation to domestic courts to limit the scope of what has been democratically debated and passed. Where a balance between competing interests has already been struck by the legislature, this Court would contradict its own position expressed in the Animal Defenders doctrine by encouraging the disregard of national democratic choices, especially if the sole reason for granting the margin of appreciation in the first place was the quality of parliamentary review.[11]
20. The judgment is, to that extent, ambiguous. It is not clear whether it affords courts a wide margin of appreciation to review legislation and strike a new balance between the rights involved (thus limiting its own scope of review), or whether it affords a small margin of appreciation to Parliament to narrowly construe a law so as to favour a privacy right that was not favoured in the plain text. It even appears to say that restrictions on Article 10 (allegedly based on the Personal Data Act) should have a wide margin of appreciation, but restrictions on Article 8 (based on the Act on Public Disclosure and Confidentiality of Tax Information Act) do not. The language is tentative at best, and no reason is given for the Court’s preference other than its desire to side with a national court against legislation. Today’s judgment clearly illustrates, once again, that there is no objective principle to apply the doctrine of margin of appreciation,[12] especially after its application in Animal Defenders. While the Court claims to be granting a wide margin of appreciation to the authorities of the respondent State to strike a balance between the rights involved, it wishes also to allow domestic Courts not only to judicially repeal what has been democratically passed, but also to redefine the meanings of “journalistic activity” and “journalistic purpose”.
21. Journalistic activity and journalistic purpose cannot be matters to be decided by domestic courts, regardless of the fact that these are context-bound concepts. It then follows that domestic authorities cannot be granted a margin of appreciation to make such a decision. A similar approach is being taken with regard to the concept of “responsible journalism”, which has been used, albeit not explicitly, to allow a less strict analysis of the balancing performed by the State and the proportionality of the measure adopted (see, respectively, Pentikäinen v. Finland [GC], no. 11882/10, § 90, ECHR 2015; and more recently, Erdtmann v. Germany (dec.), no. 56328/10, § 20, 5 January 2016). “Responsible journalism” has recently been used as one of the factors to grant a wider margin of appreciation, resulting in undermining the freedom of the press (see Rusu v. Romania, no. 25721/04, § 24, 8 March 2016, where Pentikäinen was reinterpreted and extensively applied; Bédat v. Switzerland [GC], no. 56925/08, §§ 49-54, ECHR 2016; Salihu and Others v. Sweden (dec.), no. 33628/15, §§ 53-56, 10 May 2016; Kunitsyna v. Russia, no. 9406/05, § 45, 13 December 2016; and Travaglio v. Italy (dec.), no. 64746/14, § 36, 24 January 2017). Allowing States to determine the boundaries of these concepts is to implicitly endorse a position, which is emerging in some member States, that journalistic activity that critical of the State is not journalistic but plainly illegal as a form of terrorism or a threat to national security. Article 10 does not endow national courts with such fundamental authority, and neither should this Court.
22. Having regard to the foregoing considerations and to the fact that this case involves speech of public interest expounded by a publication with journalistic purposes, the respondent State should have no wide margin of appreciation in restricting it.
D. Balancing competing rights
23. One might hold instinctive reservations against Finland’s fiscal transparency laws and request that this Court review the compatibility of such legislation with Article 8 where an affected individual submits a proper application against it. However, this is not what the Court was called to do in the present case, and it cannot do so by distorting this Court’s case-law to restrict freedom of expression. Any concerns about domestic laws that permit absolute fiscal transparency must therefore be left out of the balancing exercise.
24. It is for the Court to decide whether to apply a balancing approach or to apply the test of necessity. Hitherto this Court has applied either one or the other – never both, contrary to today’s judgment. While, according to prevailing case-law, balancing between two Convention rights requires the Court to defer to national choices, both the conflicting rights must still be given proper consideration (i.e. the Court must exercise its own scrutiny where one right is simply declared decisive without proper reasons). However, in the present case, when performing the balancing test, the domestic courts failed to take proper account of both rights at stake, and this Court did not even consider the matter, even though it is required to do so by its case-law. In cases where the balancing exercise carried out by the domestic court excluded any of the requisite considerations, the Court must find a violation. This Court’s case-law requires proper consideration of the following factors, among others.
25. First of all, the interference concerns the press and journalism. While journalism is not exempt from certain duties and responsibilities, its restriction triggers stricter scrutiny. There is little scope under Article 10 § 2 of the Convention for restrictions on political speech or on debate of questions of public interest. The most careful scrutiny on the part of the Court is called for when measures taken or sanctions imposed by the national authority are capable of discouraging the participation of the press in debates over matters of legitimate public concern (see, for example, Wingrove v. the United Kingdom, 25 November 1996, § 58, Reports 1996‑V; Bladet Tromsø and Stensaas [GC], no. 21980/93, § 64, ECHR 1999‒III; and Jersild, cited above, § 35). In the present case, the applicants published information that directly concerned matters of public interest. Issues relating to employment, pay, and fiscal transparency have already been affirmed by this Court to be of matters of public interest (see Fressoz and Roire, cited above, §§ 51 and 53).
26. Secondly, the information published by the applicants was not intended to (nor did it actually) cause any harm.[13] In weighing Article 8 against Article 10, the Court must also take into account “the seriousness of the intrusion into private life and the consequences of publication of the photograph for the person concerned” (see Gurgenidze v. Georgia, no. 71678/01, § 41, 17 October 2006). At the same time, the interference imposed a great burden and actual harm upon the applicants, ultimately forcing them into bankruptcy. The harm to the general public, in contradistinction to the harm to the applicants, was speculative and diffuse. Given the public nature of the data and the aforementioned dimensions of the published dataset, any harm directly resulting from the applicants’ publication was relatively inconsequential as regards the public at large. The absence of any individual challenge to the law only further corroborates the absence of individualised harm at stake. On the other hand, it is a major burden upon journalists to prescribe requirements on the amount of data they can collect and publish, and on the form in which they must publish it, etc.
27. Thirdly, the information published by the applicants was deemed public and was subject to no confidentiality requirements. Domestic law empowers everyone with the right to access taxpayer information[14], and Article 12 of the Finnish Constitution further guarantees a right to disseminate and receive information without prior prevention by anyone. This Court has repeatedly guaranteed that “not only do the media have the task of imparting such information and ideas; the public also has a right to receive them” (see News Verlags GmbH & Co. KG v. Austria, no. 31457/96, § 56, ECHR 2000‑I; Dupuis and Others v. France, no. 1914/02, § 35, 7 June 2007; Campos Dâmaso v. Portugal, no. 17107/05, § 31, 24 April 2008; and Axel Springer AG, cited above, §§ 79-80). When applying the balancing test in respect of Article 10, the lack or total absence of confidentiality and/or personal intimacy attached to information published by journalists must be imperative factors. In Fressoz and Roire, cited above, the Court expressly considered “whether there was any need to prevent the disclosure of information that was already available to the public and might already have been known to a large number of people” (§ 53).[15] Preventing disclosure of public information was considered unwarranted.
28. Fourthly, the applicant companies acted in good faith in publishing the taxpayer data. The standard of journalistic responsibility is subject to the proviso that journalists act in good faith in order to provide accurate and reliable information in accordance with the tenets of responsible journalism (see Pentikäinen, cited above, § 90; Bladet Tromsø and Stensaas, cited above, § 65; Fressoz and Roire, cited above, § 54; Kasabova v. Bulgaria, no. 22385/03, 19 April 2011, §§ 61 and 63-68; and Times Newspapers Ltd v. the United Kingdom (nos. 1 and 2), nos. 3002/03 and 23676/03, § 42, ECHR 2009). Unusual means of obtaining information do not constitute bad faith under this Court’s case‑law (see Stoll v. Switzerland [GC], no. 69698/01, § 103, ECHR 2007‑V; and Fressoz and Roire, cited above, § 54[16]). In accordance with the responsibility which this Court has imposed on journalists, the applicants acted in a manner that did provide reliable and precise information to the public and there was no intention to mislead (see Stoll, cited above, § 152; and Couderc and Hachette Filipacchi Associés v. France [GC], no. 40454/07, § 131, ECHR 2015 (extracts)). It was specifically recognised by the Chamber, and not contradicted by the Grand Chamber, that the applicants did not make factual errors, mislead, or act in bad faith (§ 67 of the Chamber judgment and § 98 of the GC judgment).[17]
29. Finally, the taxpayers of Finland had little or nothing in the way of expectations as regards privacy concerning the information published. It is an unequivocal requirement under this Court’s case-law that there be a “legitimate expectation of protection of and respect for his or her private life” in order for freedom of expression to “cede to the requirements of Article 8” (see Von Hannover v. Germany (no. 2) [GC], nos. 40660/08 and 60641/08, § 97, ECHR 2012). Moreover, it is mandatory that “the information at stake is of a private and intimate nature and there is no public interest in its dissemination” (see Couderc and Hachette Filipacchi Associés, cited above, § 89; and Mosley v. the United Kingdom, no. 48009/08, § 131, 10 May 2011). The information published in the present case was already accessible to everyone and was not of an “intimate” nature.[18] Thus, to extend to the present case rules specifically designed in Von Hannover and Couderc and Hachette Filipacchi Associés to cover cases concerning the dissemination of “intimate” information that has caused individualised harm is a gross misapplication of the Court’s principles.
30. This Court’s task is to determine whether the interference by the domestic authorities was based on proper and credible grounds. Having outlined the balancing factors that should have been included in the assessment, this judgment fails to demonstrate why a balancing test (even if it were applicable) requires the applicants (or other publishers) to cede to the requirements of Article 8 for publication of data concerning 1.2 million individuals but not for 150,000 individuals (see § 103 of the judgment).
E. Conclusion
31. Consecrated in Article 10, of course, is the right to “impart information and ideas without interference by public authority”. Today’s judgment subjects that right to a limitation by the respondent State that is unforeseeable and disproportionate to any legitimate aim.
32. Granting domestic authorities broad discretion to define “journalistic activity” for the purposes of Article 10 can lead to systematic efforts to curtail political speech. Note that the courts of Finland were duty bound to interpret the term journalism broadly (see Case C‑3/07 Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy and Satamedia Oy, judgment of 16 December 2008, Grand Chamber of CJEU). In the present case, the applicants, who were media professionals, were denied journalistic protection by this Court, which applied a wide margin of appreciation in handling the position of the domestic court on the basis of several criteria that must be considered arbitrary: the amount of information published, the format used for its publication, and the alleged lack of a “public interest” involved in the dissemination of taxpayer data.[19] To accept these as valid criteria for restricting journalistic expression would mean that authorities would, in the name of the “general interest”, be able to censor publications that they deemed not to promote discussion of a topic of public interest. Under the terms of Articles 8 to 11 of the Convention, there are several legitimate aims liable to justify interference in an individual’s manifestation of his or her freedom of expression. This enumeration of legitimate aims is strictly exhaustive and necessarily restrictive (see Leyla Şahin v. Turkey [GC], no. 44774/98, § 154, ECHR 2005‑XI). The aforementioned “general interest” is not included among these aims. Moreover, under the pretext of using a lenient balancing test, the Court omitted to conduct a proper review of the existence or absence of a public interest in the publication, which was deemed as voyeuristic without explanation.
33. Here, under the guise of ill-defined and diffuse privacy interests, considerations of a general interest in taxpayers’ privacy are being used, firstly, to limit a law that made such information public, and secondly, to curtail the right of journalists to impart information to the public. What is worse, this restriction was not examined under the level of stricter scrutiny required by Article 10 (2). We lament the consequent curtailment of the right of journalists to communicate accurate information of important public significance, and we therefore dissent.
[1] Act on the Public Disclosure and Confidentiality of Tax Information, section 5.
[2] The Personal Data Act governs the protection of individual privacy as concerns personal data. It provides, inter alia, that data processing must be conducted only under a specified list of conditions. However, section 2(5) of the Act exempts those engaged in “journalistic activity” from the majority of these conditions when processing personal data.
[3] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
[4] In Magyar Helsinki Bizottság v. Hungary [GC], no. 18030/11, § 109, 8 November 2016, this Court held that “[t]he collection of information was an essential part of journalism and there was an obligation on the part of the State not to impede the flow of information”. See also the Council of Europe’s ‘Recommendation No. R (2000)7 on the right of journalists not to disclose their sources of information’ adopted 8 March 2000, where the term "journalist" was defined as “any natural or legal person who is regularly or professionally engaged in the collection and dissemination of information to the public via any means of mass communication”; and ‘Recommendation CM/Rec (2011)7 of the Committee of Ministers to member States on the new notion of media’ adopted 6 July 2011, which embraced a new broad notion of media: “… encompasses all actors involved in the production and dissemination, to potentially large numbers of people, of content (for example information, analysis, comment, opinion, education, culture, art and entertainment in text, audio, visual, audiovisual or other form) and applications which are designed to facilitate interactive mass communication … while retaining … editorial control or oversight of the contents”.
[5] In Dammann v. Switzerland, no. 77551/01, § 52, 25 April 2006, the Court held that the gathering of information was an essential preparatory step in journalism and an inherent, protected part of press freedom (see also Shapovalov v. Ukraine, no. 45835/05, § 68, 31 July 2012).
[6] In some member States, data generated by secret services is sometimes accessible to historians or affected persons (“objects of surveillance”) but their divulgation to the public is subject to limitation. This can be justified as an exception (often abused in the case of communist secret service archives), but no such circumstance is present in this case.
[7] Voyeurism is defined as “The practice of gaining sexual pleasure from watching others when they are naked or engaged in sexual activity” or alternatively “enjoyment from seeing the pain or distress of others.” (Oxford Dictionary, Oxford University Press, 2017). It was used in this sense in Von Hannover (§ 65) and Couderc and Hachette Filipacchi Associés v. France [GC], no. 40454/07, §§ 99 and 101, ECHR 2015, in which cases the Court relates it generally to sexual curiosity. It goes without saying that none of the above elements is present here unless one assumes that tax data are the source of sexual pleasure.
[8] These restrictions include the obligation to protect data (section 32) and sectoral codes of conduct, orders of the Data Protection Board, and potential liability in damages and certain penal provisions as long as the data has not already been published (sections 39(3), 40(1) and (3), respectively).
[9] The judgment talks about voyeurism. Is it really the case that the personal wealth of the richest people is a matter of public interest, but is not in the case of the less well-off? Are the privacy rights of the rich less important than those of Everyman? Furthermore, the large quantity of data disclosed by the applicants actually provides the public with more accurate insights into a whole range of issues of public interest. For example, what percentage of income is paid as tax by wealthier individuals in comparison to those with more modest incomes; or to what extent is income and wealth affected by one’s gender, occupation, or municipality? (see Applicants’ submissions dated 17 March 2016, § 53).
[10] See, further on this road: National Union of Rail, Maritime and Transport Workers v. the United Kingdom, no. 31045/10, 8 April 2014, which brings into the ambit of Article 11 the wide margin of appreciation that originally applied to socio-economic policies. This is quite ironic. Under Articles 10 and 11, public interest cannot be a ground for restriction unless it is a question of public order, etc. However, once a measure qualifies as part of socio-economic policy it suddenly provides a virtual “carte blanche” in the form of a wide margin of appreciation.
[11] One of us was also a dissenting judge in Animal Defenders. According to the dissenting opinion in question the idea that the democratic process of legislation could be enabled to lower the standard of review in matters of human rights was unacceptable. Here we refer to Animal Defenders only to show the internal contradictions of the majority reasoning.
[12] See Lech Garlicki, “Cultural Values in Supranational Adjudication: is there a ‘cultural margin of appreciation’ in Strasbourg?”, in Klaus Stern, Michael Sachs, and Helmut Siekmann, Der grundrechtsgeprägte Verfassungsstaat: Festschrift für Klaus Stern zum 80. Geburtstag (2012); and George Letsas, “Two Concepts of the Margin of Appreciation”, in A Theory of Interpretation of the European Convention on Human Rights, Oxford University Press (2007), pp. 80-98.
[13]. In Fressoz and Roire v. France, cited above, § 48, the Grand Chamber expressly noted that in the Government’s view the publication of personal tax assessments belonging to one person “had been published solely with a view to damaging [him]”. Nevertheless, this Court still found in favour of the applicants, who were journalists, and held that their conviction for re-publishing tax information that was already public was a violation of Article 10. In a situation where only “local taxpayers may consult a list of the people liable for tax in their municipality, with details of each taxpayer's taxable income and tax liability” and where “that information cannot be disseminated”. Nevertheless, the Fressoz Court considered it is “thus accessible to a large number of people who may in turn pass it on to others. Although publication of the tax assessments in the present case was prohibited, the information they contained was not confidential” (§ 53.) The departure is striking.
[14] See “Act on the public disclosure and confidentiality of tax information”, No. 1346/1999, §§ 5 – 9 and “Act on the Openness of Government Activities”, No. 621/1999, §§ 2, 6, 7, 9, 13(1), 17(1), and 20 (among others).
[15] See also Weber v. Switzerland, 22 May 1990, Series A no. 177, p. 23, § 51; and the Vereniging Weekblad Bluf! v. the Netherlands, 9 February 1995, Series A no. 306-A, p. 15, § 41.
[16] The Court held, “[i]n essence, that Article [10] leaves it for journalists to decide whether or not it is necessary to reproduce such documents to ensure credibility. It protects journalists' right to divulge information on issues of general interest provided that they are acting in good faith and on an accurate factual basis and provide ‘reliable and precise’ information in accordance with the ethics of journalism.”
[17] The Court observed: “the accuracy of the published information was not in dispute even before the domestic courts. There is no evidence, or indeed any allegation, of factual errors, misrepresentation or bad faith on the part of the applicant companies” (see also, in this connection, Flinkkilä and Others v. Finland, no. 25576/04, § 81, 6 April 2010).
[18] It is not the first time that the Court has extended restrictions developed for specific situations. Here the judgment has misapplied a rule developed for data of an intimate nature without showing the similarity of otherwise different situations. Quoting magic formula from leading cases mechanically (or even in a distorted fashion as was done with regard to “responsible journalism” in Pentikäinen v. Finland) does not make the application any more convincing. We do not think that the extension is correct, but we might be mistaken. However, we are certainly not mistaken in asserting that we have nothing to contest as no reasons were given. The extension of a principle is always invidious on the simple grounds of lack of justification. Authority cannot replace reason.
[19] It is noteworthy that not even the Government denied the existence of a public interest in the publication: it only stated that it was overridden by the privacy interest: “it is obvious that the publishing activities in the aforementioned manner and extent did not contribute to public debate in a way that would override the public interest of protecting the processing of personal data of the persons concerned” (address of the Government of Finland at the Grand Chamber hearing of 14 September 2016, § 53).