## Facts

- A Swedish parish catechist created web pages on her personal computer to provide information helpful to parishioners.
- The pages were hosted on a server in Sweden but were accessible worldwide over the internet.
- The pages identified about 18 coworkers by name and included details such as their roles, duties, and, in some instances, family circumstances, telephone numbers, and hobbies.
- One page stated that a coworker had injured her foot and was on part-time sick leave.
- The catechist did not obtain coworkers’ consent and did not notify the Swedish data-protection authority before publishing the information; after complaints, she removed the pages.
- Swedish prosecutors brought criminal charges under the national data-protection statute for (i) processing without required notification, (ii) processing sensitive (health) data without authorization, and (iii) unlawful transfer of data to third countries by making it accessible on the internet.
- After a conviction and fine in the trial court, the Swedish appellate court sought a preliminary ruling on the interpretation of the EU data-protection directive.

## Issues

1. Whether posting identifiable information about individuals on a website constitutes “processing of personal data by automatic means” within the data-protection directive’s scope.
2. Whether publishing such information can fall within the “purely personal or household” exemption.
3. Whether a statement that a person injured her foot and was on part-time sick leave is “data concerning health” subject to heightened protection.
4. Whether making personal data accessible on a Sweden-hosted website constitutes a “transfer of personal data to third countries.”
5. Whether Member States may impose stricter data-protection rules than the directive permits, and what limits apply.
6. How the directive’s application should be reconciled with freedom of expression.

## Decision

- The court held that loading personal data onto a website that identifies individuals constitutes processing of personal data by automatic means covered by the directive.
- The “purely personal or household” exemption did not apply because publishing on the internet makes the data accessible to an indefinite number of people beyond private or family life.
- The statement about a foot injury and part-time sick leave qualified as data concerning health and therefore as sensitive data.
- Making data available on a website hosted in the EU, even if accessible from outside the EU, did not by itself constitute a transfer of personal data to third countries.
- Member States may adopt more protective rules in fields covered by the directive so long as those rules do not conflict with the directive’s provisions or objectives.
- Authorities applying the directive must secure a fair balance between data protection and freedom of expression; the national rules were not inherently incompatible with freedom of expression, but proportionality in application was for the national court.

## Legal Principles

- Publishing identifiable information about individuals on a publicly accessible website is “processing of personal data” by automatic means for purposes of the EU data-protection regime.
- The household/personal-activity exemption is construed narrowly and does not cover internet publication to an unrestricted audience.
- “Data concerning health” includes even limited information revealing injury or medical-related work status (such as sick leave) and triggers heightened restrictions.
- Online accessibility from third countries does not, without more, constitute a regulated “transfer” to third countries when the data is placed on a server within the EU.
- Member States may provide stricter protections than the directive, but only within bounds consistent with the directive’s structure, provisions, and aims.
- Application of data-protection rules must be balanced against freedom of expression through a case-specific assessment by national authorities and courts.

## Conclusion

The court interpreted the data-protection directive to cover noncommercial internet publication of identifiable coworkers’ information, treated a minor injury and sick leave as sensitive health data, rejected the household exemption, and held that mere worldwide accessibility of an EU-hosted webpage is not itself a third-country data transfer, while requiring national decisionmakers to balance privacy protections with freedom of expression.


Lindqvist v. Åklagarkammaren i Jönköping, Case C-101/01 (C.J.E.U. 2003)