Is Information Protection Coming Home? The Cjeu On Information Protection Constabulary In Addition To Jehovah’S Witnesses – In Addition To Political Canvassing?

Professor Steve Peers, University of Essex

You’re inwards the shower, in addition to the doorbell rings. It mightiness live on the Amazon delivery you lot were expecting, alongside your daughter’s introduce – in addition to it’s her birthday tomorrow. You fountain out of the shower in addition to dash wetly downwards the stairs to opened upwardly the door inwards time. But it’s alone a twain of Jehovah’s Witnesses.

After responding to their entreaties inwards much the same agency that Boris Johnson responds to business, you lot unopen the door, in addition to think no to a greater extent than most them. Yet they are nonetheless thinking most you. In lodge to focus to a greater extent than effectively on who to bother most God again, they locomote on a tape of each household they visit, alongside categories of (say) “Believer”, “Unbeliever”, or (if you lot couldn’t notice a towel) “Satanist”.

It’s non precisely religious enthusiasts who mightiness knock on your door in addition to get together personal data, of course. There are also businesses, charities in addition to political canvassers. For the Brexit Referendum, I joined the local Labour political party to knock on doors inwards the leafy London Borough of Remainey. If I recall correctly, nosotros kept records of voters inwards the categories of “Remain”, “Leave”, “didn’t say” in addition to “absent”. (It seems the Labour political party has stopped using the category of “Bigoted Woman”).

These activities are of involvement non precisely to preachers or spin doctors, but also information protection authorities. But does information protection constabulary apply at all to such door-knocking? The CJEU answered that inquiry yesterday, inwards a novel judgment answering questions raised inwards a dispute betwixt the Finnish information protection board in addition to Jehovah’s Witnesses.

Facts

The Finnish information protection board had ordered the Jehovah’s Witnesses to halt processing personal information unless they complied alongside Finland’s version of the EU’s data protection Directive (since replaced past times the infamous GDPR). The board asserted that both the religious community in addition to its members were “data controllers” alongside liability for the right application of information protection law. Influenza A virus subtype H5N1 lower courtroom agreed alongside the legal challenge brought past times the Jehovah’s Witnesses, but on appeal a courtroom asked the CJEU to translate the relevant provisions of European Union law.

In practise, the Jehovah’s Witnesses accept records (names, addresses, religion, identify unit of measurement status) of their meetings alongside householders. There’s also a listing (perhaps a rather longer one) of those who would similar the Jehovah’s Witnesses never to darken their door again. The dispute concerned the primary list: did it autumn inside the range of European Union constabulary at all, or was it rather exterior the range of that constabulary because of the “household exception” or the non-exhaustive safety exception to it, or because the notes were also disorganised to cast purpose of a “filing system”. Furthermore, if the Directive did apply, were both the community in addition to its private members information controllers?

Judgment

The CJEU began past times asserting that the exception for nation safety in addition to similar areas did non apply to Jehovah’s Witnesses, as that exception could alone apply to acts of the State. Secondly, the household exception did non apply either, because next prior illustration constabulary on abode safety cameras (discussed here), that exception did non apply to activity directed outward from the household. While proselytisation was covered past times the European Union Charter of Rights as an aspect of liberty of religion, that did non hateful that door-knocking cruel inside the household exception.

Next, was the note-taking purpose of a “filing system”? The Court ruled that the Directive “broadly defined” this notion: the requirement that the information live on “structured according to specific criteria” is “simply intended to enable personal information to live on easily retrieved” (para 57). No information sheets, specific lists, or other method of processing personal information was necessary to demo the beingness of a “filing system”. In this case, it was sufficient that the information was structured according to the Jehovah’s Witnesses’ criteria for a “filing system” to live on present.

Finally, are at that topographic point multiple information controllers here? Following its recent judgment on Facebook fan pages (discussed here), the CJEU reiterated a “broad definition” of that concept, although that did non hateful that every information controller had equal responsibility, or had to receive got access to the information to live on a controller. In this case, the coordination of its members’ activity past times the Jehovah’s Witnesses community made them both responsible for the information processing. This decision wasn’t affected past times the Treaty provision on the autonomy of religious bodies, next the recent judgment on discrimination constabulary in addition to religious bodies (discussed here).  In effect, such autonomy does non grant them a full general exemption from European Union law. Compliance alongside that constabulary is, inwards effect, ane to a greater extent than cross for them to bear.

Comments

It makes feel that the household exception does non apply to Jehovah’s Witnesses, given that inwards do many homeowners either do non opened upwardly their doors to the eager evangelists, or slam the doors inwards their faces if they do. It’s also hitting that the Court takes a wide Definition of “filing systems”. That’s consistent alongside its wide interpretation of the range of European Union information protection constabulary inwards many cases, in addition to its interpretation of “data controller” reiterated here; but UK of Britain in addition to Northern Republic of Ireland information protection lawers volition live on aware that it contrasts alongside the narrower Definition of “filing systems” inwards UK illustration law. The Court’s emphasis on articulation responsibleness of information controllers echoes its recent judgment on Facebook in addition to friends, as noted above.

That leads us to the broader implications of the judgment: its potential impact on politics. There’s no argue to uncertainty that the judgment applies as to political canvassing, as the collection of information in addition to human relationship alongside householders is similar, in addition to the Charter protection for liberty of facial expression would past times analogy non protect parties from the application of information protection constabulary either. The insistence on articulation responsibleness of information controllers poses a possible complication for door-knockers of either type: they must live on aware non alone of the inspiring words of Jesus Christ or Jeremy Corbyn, but also the infinitely drier text of the GDPR, a prospect which certainly enthuses non the many, but the (very, very) few.

But spell nosotros know that European Union information protection constabulary applies to such activities, in addition to that responsibleness is shared, nosotros don’t know how to apply the constabulary inwards such cases, as the Court wasn’t asked. (The before ruling on abode safety cameras similarly leaves such possible questions unanswered). On what grounds tin dismiss the information live on processed? Must homeowners give their consent to the processing for specific reasons? One tin dismiss imagine that those who are already reluctant to hash out their faith alongside Jehovah’s Witnesses volition live on fifty-fifty to a greater extent than reluctant to hash out the minutiae of information protection consent alongside them too. Can the legitimate involvement of evangelists or political canvassers justify the processing of data? Or tin dismiss a statute validly regulate this issue? (One suspects that politicians volition live on especially non bad to notice fourth dimension to legislate to justify their ain activities, if necessary).

The judgment – combined alongside the recent Facebook fan page judgment – mightiness also receive got implications non alone at the low-tech halt of political canvassing, but at the high-tech halt too. Today sees the publication of the UK of Britain in addition to Northern Republic of Ireland Information Commissioner’s study into allegations of breaches of information protection constabulary during the Brexit referendum, including also allegations most Facebook’s run alongside Cambridge Analytica. The ICO also published suggestions on information protection constabulary in addition to the democratic process. (See also the recent publications from the Electoral Commission in addition to an Independent Commission on Referendums). Traditionally it’s been easier to address concern most the fairness of political processes because people article of apparel ruby or bluish rosettes when knocking on the door, or parties identity themselves inwards political literature or broadcasting. It’s far harder where online political messaging is questionably funded, poorly regulated (particularly as regarding funding limits in addition to unusual funding) in addition to often dishonest.  Recent judgments in addition to regulatory efforts are babe steps towards addressing these essential concerns.

Photo credit: JW.org

Share this post