The Strasbourg Court's judgment reflects on the collection of personal data carried out by a religious community in the course of its propaganda activities without the consent of the persons concerned. The applicants, indeed, complained of violations of, inter alia, Article 9 ECHR in the decision of the Finnish authorities, also supported by a preliminary ruling of the EU Court of Justice, to prohibit from collecting and processing personal data in connection with door-to-door preaching without fulfilling the general requirements for the processing of sensitive data specified in the Personal Data Act, i.e. without the unambiguous consent of the data subject.

 

Let us come to the facts: in 2013, the Finnish Data Protection Board, following an application by the Data Protection Authority, had prohibited the plaintiff religious community, Jehovah's Witnesses, from doing so. After it had also been clarified by the CJEU that the community was to be considered a 'controller' of personal data collected and processed by its members in the course of door-to-door preaching within the meaning of Directive 95/46/EC on data protection, the Administrative Court held that the appellant community and its data-collecting members were to be considered controllers within the meaning of the law and ordered the community to ensure, within six months, that no personal data were collected for its purposes without the prerequisites for the processing of such data being met.

 

Having exhausted the domestic remedies, Jehovah's Witnesses therefore turned to the European Court of Human Rights, complaining in particular of violations of Article 9. The application of the requirement of consent to the collection and processing of personal and sensitive data in the course of door-to-door preaching, a religious activity designed to manifest or spread the faith, certainly constitutes an interference with the community's freedom of propaganda. The central issue in the present case is therefore the striking of the right balance between the community's right to religious freedom and the right to privacy of the persons concerned, as enshrined in national data protection legislation and as protected by Article 8 of the Convention.

First of all, the interference was provided for by law, namely the Personal Data Act, in force at the material time, which had transposed the Data Protection Directive and had pursued the legitimate objective of protecting 'the rights and freedoms of others', in this case the data subjects. Indeed, the law was intended to ensure the protection of the right to respect for private life, including the right to privacy of those whose data were collected.

In the absence of evidence and counter-arguments from the requesting community, the Finnish Supreme Administrative Court had ruled that individual Jehovah's Witnesses, at least in general, did not ask the data subjects to expressly consent to the processing of their personal data, nor did the community provide them with instructions to do so. The Strasbourg judges, agreeing, held that the order to ensure, within six months, compliance with the requirements had not been issued in an attempt to hinder the religious practices of individual Jehovah's Witnesses, but rather for reasons having to do with the processing of personal data. The right to privacy also belongs to the persons whose personal data are processed, who have the right to expect that the provisions on the processing of personal data will be respected.

The ECtHR, therefore, agreed with the Supreme Administrative Court that the data subjects had a reasonable expectation of privacy with regard to personal and sensitive data collected and processed in the course of door-to-door preaching. The fact that some personal data might already be in the public domain did not reduce this expectation, nor did it mean that such data needed less protection. This approach found support in the relevant case law of the CJEU. The requirement of consent must be regarded as an appropriate and necessary safeguard to prevent any disclosure or dissemination of personal and sensitive data contrary to the guarantees of Article 8, even in the context of door-to-door preaching by individual Jehovah's Witnesses. Indeed, the Court failed to understand how the mere request for and receipt of the consent of the data subject could hinder the essence of the applicant community's freedom of religion. The applicant community presented no evidence in support of the alleged 'chilling effect' of the Board's order, despite the time that had elapsed. Moreover, the law applies indiscriminately to all religious communities and their activities - therefore, there can be no question of discrimination - and no fine had been imposed on the applicant community.

Consequently, there were no valid reasons for the Court to censure the position adopted by the national courts and to oppose the balancing carried out by them. The reasons given were relevant and sufficient to show that the interference was 'necessary in a democratic society' and the authorities had acted within their margin of appreciation in striking a fair balance between the interests at stake.

 

The Court therefore unanimously held that there had been no violation of Article 9 ECHR, based on the incompatibility of the applicant community's religious activities with data protection rules.

 

(Comment by Alessandro Negri)