Volume I

Issue : 9: October 30, 2003

• European Union AntiSpam Law Comes into Force
• Law Firm Protected from Liability for Internet Posting
• New Online System Launched To Manage Copyright Clearance For Canadian Literatures
• European Court of Justice Rules on Italys Internet Gambling Ban in Gambelli Case
• Privacy Commissioner Outlines the Requirements for OptOut Form of Consent
• UN Study Analyzes Status of E-Government
• Canadian Doctors reprimanded For U.S. Prescriptions
• U.S. Court Grants Injunction Against Internet Drug Importer
• Favourable Decision for Digital Music and Video Download Patent Holder
• European Court of Justice Rules on Interpretation of Data Protection Directive
• FCC to Study VoIP Issues Minnesota Appeals Vonage Decision

Home > Volume I > Issue 9: October 30, 2003 > European Court of Justice Rules on Interpretation of Data Protection Directive

European Court of Justice Rules on Interpretation of Data Protection Directive

The European Court of Justice (the "ECJ") recently delivered an important decision regarding the interpretation of the European Data Protection Directive (the "Directive") that arose as a reference from the Swedish Court of Appeal (the "Swedish Court") requesting that the ECJ answer several questions about the interpretation of the Directive.

The appellant before the Swedish Court appealed her criminal conviction under the provisions of Swedish legislation (the "Swedish Act"), which implemented the Directive in Sweden, for publishing the personal data of persons working with her in a parish of the Swedish Protestant Church. More specifically, the appellant was charged under the Swedish Act for processing personal data by automatic means without giving prior written notification to the Datainspektionen (the Swedish Data Inspection Board), processing sensitive personal data without authorization and transferring processed personal data to a third country without authorization. The questions referred to the ECJ were designed to assist the Swedish Court in interpreting the Swedish Act.

The ECJ confirmed that the act of referring, on an Internet page, to the appellant's colleagues in the church and identifying them by name, telephone number or information regarding their working conditions and hobbies did constitute the processing of personal data wholly or partly by automatic means within the meaning of the Directive.

On the question of whether the loading of personal data in Sweden onto a home page, stored on a server in Sweden, constituted a transfer of data to a third country within the meaning of the Directive, the ECJ held that it was not such a transfer.

The ECJ was also asked to consider whether the Directive conflicted with the principle of freedom of expression enshrined in the European Convention of the Protection of Human Rights and Fundamental Freedoms (the "ECHR"). On this issue, the ECJ found that the provisions of the Directive do not, in themselves, conflict with the ECHR, rather it is for the national authorities responsible for applying the national legislation implementing the Directive to ensure a fair balance between the right to freedom of expression in the ECHR and the right of privacy established by the Directive.

Finally, on the question of whether member states of the European Union could provide for greater protection of personal data or a wider scope than required under the Directive, the ECJ held that the measures taken by the member state must be consistent with the provisions and objectives of the Directive, but that nothing prevented the member state from extending the scope of its national legislation to areas not included in the scope of the Directive.

For a copy of the decision, visit:

http;//makeashorterlink.com/

For a copy of the European Data Protection Directive, visit:

http://europa.eu.int/comm/internal_market/privacy/law_en.htm