The Boundary of the Private: Lindqvist (Case C-101/01) on Scope, Exemption and Proportionality under Directive 95/46/EC

Abstract

In Lindqvist (Case C-101/01, judgment of 6 November 2003), the Court of Justice of the European Union held that a church volunteer who published information about parish colleagues on a personal web page was subject to Directive 95/46/EC and fell within neither of its exemptions. The decision is usually summarised as holding that the household exemption does not extend to the internet. This article examines the judgment closely, with attention to a question the Court never states as such: how the law treats activities and information that are private and public at the same time. It argues that the judgment answers that question differently at three stages (scope, exemption and proportionality), gives a firm answer at only one of them, and that a clear line between private and public exists at the extremes but not in the intermediate cases.

1. Introduction

Data protection law in the European Union does not ask whether information is secret, but rather whether it relates to an identifiable person and whether it has been processed. Under EU law, unlike traditions based on a “reasonable expectation” of privacy, information placed in public view does not lose protection. The hard questions arise elsewhere: when an individual’s own activity is so personal that the law stays away, and when it has become public enough that it does not.

Lindqvist case was the first major decision applying the Data Protection Directive to the internet, and it did so on facts that remove all ordinary reasons for regulatory concern: an unpaid volunteer, a benign motive, a religious setting and trivial content. The case concerned text, not photographs; photographs of church members are discussed in Part 9.4 as an application of the reasoning.

2. Facts and Procedural History

Bodil Lindqvist, a maintenance worker, also served as a catechist in the parish of Alseda, Sweden. At the end of 1998, after a computing course, she built pages on her home computer so that parishioners preparing for confirmation could find practical information, and the Church’s website administrator linked to them at her request (¶12). The pages described Ms Lindqvist and 18 colleagues, some by full name and some by first name, mentioning their jobs and hobbies “in a mildly humorous manner”, in many cases family circumstances and telephone numbers, and the fact that one colleague had injured her foot and was working half-time on medical grounds (¶13). She told no one, obtained no consent and did not notify the Swedish supervisory authority. She removed the pages once she learned some colleagues disliked them (¶14).

She was prosecuted for processing personal data by automatic means without notification, processing sensitive data without authorisation, and transferring data to a third country without authorisation (¶15). The Eksjö District Court fined her SEK 4,000 (¶17), and the Göta Court of Appeal referred seven questions. The Court of Justice sat as a full chamber, with an Opinion from Advocate General Tizzano delivered on 19 September 2002.

Two features matter below. The data subjects were third parties met through a shared institutional role, not members of her household. And the motive was religious and unpaid.

3. The Statutory Framework

The relevant provisions are best read as a structure rather than a list.

Dual purpose. Article 1(1) commits the Directive to protecting fundamental rights, “in particular the right to privacy”, in the processing of personal data (¶3). Its internal-market purpose is to remove obstacles to the free movement of that data. The Court acknowledged that these aims “may of course be inconsistent with one another” (¶79).

Scope indifferent to publicity. “Personal data” is any information relating to an identified or identifiable person (Art 2(a)), and “processing” is any operation on it, including “disclosure by transmission, dissemination or otherwise making available” (Art 2(b)) (¶¶24–25). Nothing in these definitions asks whether information is secret, sensitive or already known.

Two narrow exemptions. Article 3(2) excludes processing in the course of an activity outside Community law, and processing “by a natural person in the course of a purely personal or household activity”.

Sensitive data. Article 8(1) prohibits processing data revealing, among other things, religious or philosophical beliefs, and data concerning health. Article 8(2) lifts the prohibition in listed cases, two of which are relevant: religious non-profit bodies processing members’ data, provided it is “not disclosed to a third party without the consent of the data subjects” (8(2)(d)), and data “manifestly made public by the data subject” (8(2)(e)).

The structure is therefore a wide scope, two narrow exemptions, and balancing at the application stage. “Public” and “private” do not appear as categories. They enter as factors within the household exemption and within proportionality.

4. Scope of the Directive: Article 3(1)

The Court’s reasoning on scope is short (¶¶24–27). A name combined with a telephone number or details of working conditions or hobbies is personal data. Loading it onto a page is “making data available”. Putting a page on the internet involves loading it onto a server and making it accessible, operations “performed, at least in part, automatically” (¶26). Ms Lindqvist had argued that merely mentioning a name in a document was not automatic processing, though a name in a search-indexing meta tag might be (¶20). The Court declined to separate content from machinery.

The deeper challenge concerned the legal basis. Ms Lindqvist argued that applying the Directive to non-commercial individual expression would exceed the powers conferred by Article 100a of the EC Treaty, since internal-market harmonisation cannot regulate free expression (¶30). Relying on Österreichischer Rundfunk, the Court held that use of that basis does not require “an actual link with free movement” in each case (¶40), and that a case-by-case test would make the Directive’s limits “particularly unsure and uncertain” (¶41).
This is the first point at which a public/private distinction was offered to the Court and refused. The argument was that non-economic expression sits in a private zone. The Court’s answer was that scope turns on what is done with data, not why. The cost is plain: a measure adopted for the internal market was applied to a volunteer’s hobby page. After the Lisbon Treaty, Article 16 TFEU supplies an independent basis for data protection rules, which lessens the force of the objection today.

5. The Exemptions in Article 3(2)

5.1 The First Indent: Activities Outside Community Law
The Court read this exemption by reference to its listed examples (Titles V and VI TEU, public security, defence, State security, criminal law), which are “activities of the State or of State authorities and unrelated to the fields of activity of individuals” (¶43). The exemption therefore covers only listed activities or those of the same kind (¶44), and charitable or religious work is not of that kind (¶45). Free expression is not a State activity, so this exemption cannot function as a free-speech exemption.

5.2 The Second Indent: “Purely Personal Or Household Activity”
The reasoning is in two paragraphs. Paragraph 12 gives “correspondence and the holding of records of addresses” as examples of exclusively personal or domestic activity (¶46). The exemption “must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people” (¶47).

Three observations follow.

First, the Court’s examples share a feature it does not name. A letter goes to a chosen addressee; an address book is kept for its owner’s use. Both are bounded: the author controls who sees the data. The Court moves from these examples to a general rule about “private or family life”, and the word that carries the step is “indefinite”.

Second, ¶47 combines two ideas without separating them, that is, whose life the activity belongs to (private or family life), and how far the data travel (an indefinite number of people). On the facts both pointed the same way, because the data subjects were colleagues and the audience was the world. The judgment therefore does not say what happens when they diverge: an open page about one’s own family, or a small closed circulation of material about colleagues.

Third, “indefinite number” operates as a sufficient condition for losing the exemption, not a complete test. The Court did not hold that a limited audience guarantees it.
Advocate General Tizzano reached the same conclusion, recording the Commission’s two reasons: a home page is reachable by anyone using a search engine, and household activities by definition concern only the processor’s own private life. These correspond to the audience and “whose life” limbs.

5.3 The Argument The Court Did Not Answer
Ms Lindqvist told the Court that the information was “in the public domain, well-known or trivial” and so no significant breach of private life (¶74). That was a public/private argument at the level of scope. The Court never addressed it directly. The point reappears in ¶89, where the national court is told to weigh “the importance, for the persons concerned, of the protection of the data disclosed”. The publicity or triviality of information was thus moved from scope to proportionality. This is the most important structural move in the judgment for present purposes, and it is not announced.

6. Special Categories of Data: Article 8(1)

The Court held that “data concerning health” must be given “a wide interpretation so as to include information concerning all aspects, both physical and mental, of the health of an individual” (¶50), so that the statement about the injured foot and half-time medical leave qualified (¶51).
The Court did not weigh the triviality of the remark: a friendly sentence is classified like a diagnosis. It was also not asked about the Article 8(2) exceptions. On this article’s reading, neither would have helped: the religious non-profit exception is lost where data are disclosed to third parties without consent, and the “manifestly made public” exception concerns publication by the data subject, which the colleague had not done. The classification matters mainly because it raises the stakes of the later proportionality exercise.

7. Transfers to Third Countries: Article 25

The Court was confronted with the question whether placing a page on a website located in Sweden constitutes a “transfer to a third country” since it could be accessed outside Sweden (¶52). It responded negatively on two grounds.
The first was substantive: an internet user had to “personally carry out the necessary actions to consult those pages”, and the pages “do not provide the technical means for transmitting information to persons not seeking them” (¶60). Information passed through the host, not from the drawer to the reader (¶61). 

The second ground was formal: Chapter IV does not contain criteria specific to the Internet (¶67). If every placing of information on the Internet accessible in another country qualified as a transfer to that country, the special regime would become “a regime of general application”, since “one negative finding on adequacy would require all Member States to adopt measures prohibiting any publication on the Internet” (¶69).
This is a pragmatic response, which leaves the impression of a discretion-driven balancing test. It is difficult to reconcile it with ¶47, where the very fact that the Internet is a medium with global reach transforms publicity into a non-private act. If scope (accessibility) determines the application of cross-border data-protection rules, it fails to qualify as such in determining whether publication is a “transfer”.

8. Freedom of Expression, Proportionality and Sanctions

The sixth question asked whether the Directive’s application to the case was compatible with freedom of expression guaranteed by Article 10 of the ECHR. The Court stated that the freedom of expression “is a fundamental right which is in principle freely exercisable within the Member States” but the Directive “quite properly includes rules with a degree of flexibility” and therefore “the assessment of proportionality must be carried out at the level of national law when implementing the Directive” in each case (¶83, ¶85).

The Court identified the interests protected by the Directive, which in the present case included “the freedom of expression in her work preparing people for Communion and her freedom to carry out activities contributing to religious life” and the private life of the persons whose lives Ms Lindqvist had made public (¶86). The interest in disseminating religious teachings thus balanced Ms Lindqvist’s interest in her profession as a pastor.

The right to freedom of expression comes with limitations. Sanctions for privacy violations “must always respect the principle of proportionality”, particularly because of the broad scope of the obligations imposed by the Directive and their diverse effects (¶88). National courts reviewing damages claims had to take into account “all the circumstances of the case, inter alia the duration of the breach and the importance, for the persons concerned, of the protection of the data disclosed” (¶89). 

Read in conjunction with ¶17, which refers to a pecuniary penalty imposed by the national court, this formulation suggests that the Court identified one acceptable way of responding to the broad scope of the Directive – by limiting the quantum of sanctions for privacy violations. 

However, it did not provide a definitive answer on this issue, only stating that the national courts have to apply proportionality in each case with due regard to all circumstances. The Court also drew attention to the fact that the Member States could go beyond the scope of the Directive when supplementing it with national laws (¶98).

9. Analysis: Private and Public in Data Protection Law

9.1 Three stages at which publicity matters differently
Lindqvist never treats privacy as a property of information. The more useful question is at which stage publicity matters, and in what way.

The common error is to collapse these stages. That information is already public, trivial or findable is not a reason for the law to stop at scope, which is what Ms Lindqvist argued (¶74). That a processing activity is public in reach is what disqualifies it from the exemption.

9.2 Where a clear line can be drawn
At the exemption stage the law provides a clear answer for the poles. A letter to a friend, a private address book and a diary are inside. An openly accessible web page about people outside one’s household is outside. The Court’s examples (¶46) and its criterion (¶47) fix both ends.

 
9.3 Where It Cannot: Factors From Later Case Law
Between the poles, Lindqvist offers only one sufficient condition, an indefinite audience. Later decisions provide additional considerations; the wording has not been cross-verified against primary text for this draft.

• Ryneš (C-212/13, 2014): a domestic CCTV camera partially covering a public street. The exemption was narrowly construed and ruled inapplicable as the processing was directed outward from the private setting.
• Jehovan todistajat (C-25/17, 2018): notes taken by members of a religious community on going door-to-door preaching. Not purely personal or household, as the activity exceeded the private sphere of those carrying it out. It is the nearest religious analogue and confirms that the religious motivation does not itself create an exemption.
• Buivids (C-345/17, 2019): a video shot in a police station and posted on a video website. The reasoning of ¶47 was applied to the publication to an indefinite audience.
  Together, these suggest a three-part inquiry. Reach: is the audience bounded and selected, or open? Direction: is the processing directed inwards to the individual’s own life or outwards to the world? Relationship: does the data concern the individual’s own private and family life or people encountered through a role, institution or public setting? Lindqvist rests almost entirely on the first. The second and third are drawn from later cases and from the structure of ¶47, and this article does not claim that the Court has stated them as a single test.

9.4 Application: Church Premises And Photographs
A church is a place that is private and public in one: intimate in its relationships, communal in its membership and public in its activities. Photographs of a confirmation service illustrate the issue. Posted on an open parish website, reach and direction point outward and the relationship is institutional, so the exemption is lost.

The images may also reveal religious belief and so engage the special-category rules (an inference of this article, as the Court did not address it). Shared with a small closed group of relatives who attended, all three factors point inward and the exemption is plausible. Shared in a parish-wide group run by a volunteer, the audience is bounded but the relationship and purpose are institutional, and the answer is genuinely uncertain. That uncertainty belongs to the law and is not a gap in the analysis.

10. From Directive 95/46/EC to the GDPR

The GDPR maintains the exemption in Article 2(2)(c). Recital 18 adds that it covers processing “without a connection to a professional or commercial activity”, citing correspondence, address-holding and “social networking and online activity undertaken within the context of such activities”. 

This does not undermine Lindqvist. The Court’s statement that the non-economic nature of Ms Lindqvist’s activity was irrelevant (¶39) concerned whether EU law applied at all; Recital 18 concerns the limits of the household exemption.
The GDPR also provides tools the Directive lacked in 2003: a legitimate-interests basis in Article 6(1)(f) that can accommodate modest community publication; Article 9(2)(d), preserving the religious-body route for members’ data with the same disclosure limit; Article 85, requiring Member States to reconcile data protection with expression; and Article 91, recognising churches’ own data protection rules where they conform to the Regulation. The Charter (Articles 7, 8, 10 and 11) thus now provides the framework wrt the rights .
A contrast with India is instructive. The DPDP Act is understood to exclude data the data principal has made publicly available (s. 3; wording to be verified before citation). In the EU model, publicly available data remain protected, and Article 8(2)(e) relaxes only the special-category prohibition, and only where the data subject made the data public. “Public” is an exemption trigger in one system and a proportionality factor in the other.

11. Critical Assessment

• Breadth. On the Court’s reading, anyone who names a colleague on an open page is a controller. The Court relied on proportionality to make this tolerable (¶88). The risk is a law that affects everyone and is enforced against few.
• “Indefinite number” is blunt. It does not distinguish a page seen by ten people from one seen by millions. The Article 29 Working Party’s Opinion 5/2009 on social networks expanded on the idea that access beyond self-selected contacts removes the exemption, but the boundary is contested.
• Silences. The Court did not address the Commission’s Article 9 argument (¶33) or the Article 8(2) exceptions, and ¶89 provides factors without a method.
• Limitations of this analysis. Advocate General Tizzano’s Opinion has been consulted only through the passages quoted, and the later cases and the DPDP Act provision have not been re-read against primary text for this version.

12. Conclusion

Lindqvist does not tell us what is private and what is public. It shows that data protection law asks the question at three points and answers it differently at each. At the level of scope, the publicity of information is irrelevant. At the exemption, the publicity of the audience is decisive, and an indefinite audience is enough to lose it. At proportionality, the publicity of information returns as a reason to moderate the response.

A clean demarcation therefore exists, but only for activities and only at the poles: bounded, inward-facing communication about one’s own private life lies outside the law, and open, outward-facing publication about others lies inside it. The middle ground is governed by judgment, informed since Lindqvist by reach, direction and relationship. The Court’s lasting insistence is that being within the law is not the same as being liable to its full weight. That separation of applicability from severity is the case’s most durable contribution, and the one most often lost in summary.