When opening the door to the Jehovah’s Witnesses it is probably uncommon for householders – even for the erudite and very pretty readers of this blog – to respond that although they have not found Jesus, they have found a copy of the register of data controllers, on which the Witnesses do not seem to appear.
Such was the issue in the easily pronounceably named Case C-25/17 Tietosuojavaltuutettu (ECLI:EU:C:2018:551), a reference from Finland concerning whether Jehovah’s Witnesses were data controllers, as a community or as individual members, when collecting or processing data in the course of door-to-door preaching.
The answer given by the CJEU was that individual members going door-to-door are indeed data controllers. Such activity does not fall within the limited scope of the personal or household activities exemption in Article 3(2) of the Directive. The CJEU reminded us that it is the putative controller’s activity which needs to be personal or domestic, not that of the data subject (at [41]), and cannot be purely personal or domestic if the data collected is made accessible to an unrestricted number of people or is, even only partly, taking place in a public space (at [42]). Going to the doors of non-Witness members is activity directed outwards from the private setting of the members themselves: at [44]. They were, accordingly, data controllers under the Directive.
Reliance had been placed on the freedom of religion protected in Article 10 of the Charter. The CJEU affirmed that right, but explained it did not determine whether activity of this sort was exclusively personal or domestic: at [49].
The CJEU also considered the role of the Jehovah’s Witness Community and whether it too was a data controller. It held that a person exercising influence over the processing of personal data can be a controller, whether or not it has issued written instructions to that effect: at [67]-[68]. The community centrally organised, coordinated and encouraged the preaching activity in which personal data was processed, including by way of lists of persons who do not wish to receive a further visit. The CJEU stopped short of formally finding that the community itself was also a data controller, but gave a pretty strong hint to the national court as to where it thought the answer lay (i.e. it was): at [70]-[73].
As if this were not exciting enough, the CJEU also addressed that most sexy of all data protection questions: the concept of a “filing system” within the meaning of Article 2(c).The CJEU confirmed that a filing system must be structured according to specific criteria, which ought (see the recitals) to relate to individuals, such that data can be easily retrieved. Beyond that, the CJEU was not prepared to go, and no particular form or format was required: at [57]-[58]. However, it considered that the evidence supported a conclusion that the data collected was being structured according to criteria to allow members to establish where they had been, who they had seen and who did not wish to be visited again. So long as the data of a specific data subject can be “easily retrieved”, it does not matter exactly how the filing system has been structured: at [61].
There is then truly important observations in the judgment about that holy grail of data protection law: who is a data controller and when? Unfortunately, as all grail-hunters know, the judgment fails to remind us that in Latin, Jehovah is spelled with an ‘I’.
Christopher Knight