CEDH · CASELAW;JUDGMENTS;CHAMBER;ENG — 9 mai 2023

.s800EAC49 { font-size:12pt } .s20FDDAE9 { margin-top:12pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .sBB9EE52A { font-family:Arial } .sC02E897A { margin-top:42pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .s34DFC730 { margin-top:0pt; margin-bottom:0pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .s339D85E6 { margin-top:0pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s59272B2C { margin-top:0pt; margin-bottom:6pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s88D564B { margin-top:0pt; margin-bottom:0pt; text-align:justify; border:0.75pt solid #000000; padding:1pt 4pt } .s51C60BCC { margin-top:0pt; margin-bottom:22pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s598389FB { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:14pt } .sF5E1C6CF { font-family:Arial; font-weight:bold; text-decoration:underline; color:#ff0000 } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .sE208486F { font-family:Arial; color:#ff0000 } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sB9D5CABB { width:28.35pt; display:inline-block } .s28D8D01E { margin-top:14pt; margin-left:42.55pt; margin-bottom:12pt; text-indent:-14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s3CA22BA { font-family:Arial; text-transform:uppercase } .s4BAE41EE { font-family:Arial; font-size:11pt } .s6B505E72 { margin:0pt; padding-left:0pt } .s577F9E9 { margin-top:14pt; margin-left:54.27pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:2.48pt; font-family:Arial; text-transform:uppercase } .sA451BBF4 { margin-top:14pt; margin-left:56.75pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; text-transform:uppercase } .s743F3A55 { margin-right:0pt; margin-left:0pt; padding-left:0pt } .sAAECEA10 { margin-left:-28.4pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; font-weight:bold; text-transform:none } .sFA80848F { margin-top:14pt; margin-left:28.35pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-weight:bold } .s9D48DD53 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; font-size:10pt } .s2616CC02 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify; font-size:13pt } .s4B4B41EE { font-family:Arial; font-size:12pt } .sE810360E { margin-left:54.27pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:2.48pt; font-family:Arial; text-transform:uppercase } .s9D0F61E3 { margin-top:14pt; margin-left:28.35pt; margin-bottom:12pt; text-indent:-14.15pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s4DDA3AA3 { font-family:Arial; font-weight:bold; font-style:italic } .s7C908E6D { margin-top:14pt; margin-left:8.5pt; margin-bottom:12pt; text-indent:5.7pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s4D0F3C2E { width:2.15pt; text-indent:0pt; display:inline-block } .s3A692EA6 { margin-top:14pt; margin-bottom:6pt; text-align:center; page-break-after:avoid; font-size:10pt } .sA2548810 { margin-top:14pt; margin-bottom:0pt; text-align:center; page-break-after:avoid; font-size:10pt } .s718D1C37 { margin-top:0pt; margin-bottom:6pt; text-align:center; page-break-after:avoid; font-size:10pt } .s660B4BF2 { margin-left:56.8pt; margin-bottom:6pt; page-break-inside:avoid; page-break-after:avoid; font-weight:normal; font-style:italic } .sA3E47BD { margin-top:0pt; margin-left:99.35pt; margin-bottom:6pt; text-indent:-14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sBD419D00 { width:1.98pt; font:7pt 'Times New Roman'; display:inline-block } .s21338552 { font-family:Arial; font-size:10.5pt } .s6C09A5E4 { margin-top:14pt; margin-left:99.35pt; margin-bottom:6pt; text-indent:-14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s68242971 { width:1.43pt; font:7pt 'Times New Roman'; display:inline-block } .sA10B3FF1 { margin-top:14pt; margin-left:85.15pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-style:italic } .sECF8538A { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sF6DCB0C9 { width:12.7pt; display:inline-block } .s5E8F5A28 { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-weight:bold } .s5085E950 { margin-top:0pt; margin-left:113.55pt; margin-bottom:6pt; text-indent:-14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; line-height:113%; font-size:10pt } .s3EA7A0E { width:5.32pt; font:7pt 'Times New Roman'; display:inline-block } .sC2F2758B { margin-top:14pt; margin-left:113.55pt; margin-bottom:6pt; text-indent:-14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; line-height:113%; font-size:10pt } .s5916B642 { width:3.1pt; font:7pt 'Times New Roman'; display:inline-block } .sCB4E9696 { width:0.87pt; font:7pt 'Times New Roman'; display:inline-block } .sF7177B22 { width:0.32pt; font:7pt 'Times New Roman'; display:inline-block } .sD11CFAB7 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; padding-left:1.99pt; font-family:Arial } .sFBC99493 { font-style:italic } .s2D9C6089 { margin-top:12pt; margin-bottom:12pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s568E28F9 { margin-top:84pt; margin-bottom:0pt } .s4F597665 { width:33.22pt; display:inline-block } .sEEEC397 { width:146.09pt; display:inline-block } .s5A65B3DC { width:46.56pt; display:inline-block } .s44B8752F { width:177.11pt; display:inline-block } SECOND SECTION CASE OF JEHOVAH’S WITNESSES v. FINLAND (Application no. 31172/19)   JUDGMENT   Art 9 • Manifest religion or belief • Decision prohibiting Jehovah’s Witnesses religious community from collecting and processing personal data during door-to-door preaching without data subjects’ consent • Interpretation of relevant data protection provisions, following guidance by Court of Justice of the European Union, not arbitrary or unreasonable • Statutory consent requirement an appropriate and necessary safeguard with no evidence of any “chilling effect” • Relevant and sufficient reasons • Fair balance struck between competing Art 9 and Art 8 interests • Interference “necessary in a democratic society” and within State’s margin of appreciation Art 6 (administrative) • Exceptional circumstances which justified dispensing with oral hearing   STRASBOURG 9 May 2023 FINAL   25/09/2023     This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Jehovah’s Witnesses v. Finland, The European Court of Human Rights (Second Section), sitting on 4   April 2023 as a Chamber composed of:   Arnfinn Bårdsen, President ,   Jovan Ilievski,   Egidijus Kūris,   Pauliine Koskelo,   Lorraine Schembri Orland,   Diana Sârcu,   Davor Derenčinović, judges , and Hasan Bakırcı, Section Registrar , Having regard to: the application (no.   31172/19 ) against the Republic of Finland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Finnish religious community, the Jehovah’s Witnesses ( Jehovan todistajat – “the applicant community”), on 10   June 2019; the decision to give notice to the Finnish Government (“the Government”) of the complaints under Articles 6, 8, 9 and 10 of the Convention, Article 14 read in conjunction with Articles 8, 9 and 10 of the Convention, and Article 1 of Protocol No. 12 to the Convention; the parties’ observations; Having deliberated in private on 4 April 2023, Delivers the following judgment, which was adopted on that date: INTRODUCTION 1.     The application concerns the incompatibility, as established by the domestic authorities, of the religious activities of the applicant community (Jehovah’s Witnesses) with data protection regulations regarding personal data collected in the context of door-to-door preaching without the explicit consent of data subjects. The applicant community relied on Articles 6, 8, 9 and 10 of the Convention, Article 14 read in conjunction with Articles 8, 9 and 10 of the Convention, and Article 1 of Protocol No. 12 to the Convention. THE FACTS 2.     The applicant community, the Jehovah’s Witnesses, is a Finnish religious community based in Vantaa. It was represented before the Court by Mr P. Muzny and Mr S.H. Brady, lawyers practising in Strasbourg. 3.     The Finnish Government (“the Government”) were represented by their Agent, Ms K. Oinonen, from the Ministry of Foreign Affairs. 4.     The facts of the case may be summarised as follows. 5 .     In October 2000 the Data Protection Ombudsman ( tietosuojavaltuutettu, dataombudsmannen – “the Ombudsman”) issued an opinion (89Û/45/97) about the applicant community’s data collection practices indicating, inter alia , that personal data could be collected in the course of door-to-door preaching by individual Jehovah’s Witnesses only with the consent of data subjects. With reference to that opinion, in 2011 a complaint was lodged with the Ombudsman regarding the way in which Jehovah’s Witnesses took notes during their door-to-door preaching and whether such notes amounted to personal data forming a “personal data file” within the meaning of the Personal Data Act ( henkilötietolaki , personuppgiftslagen , Act no. 523/1999 – see paragraphs 30-35 below). It was alleged, inter alia , that deaf people and foreigners were visited by Jehovah’s Witnesses who knew sign language and the foreign language respectively. Reference was also made to instructions published in a leaflet entitled “Our Kingdom Ministry” and an official form (S-43) used for that purpose. In response to the Ombudsman’s requests for clarification, the applicant community confirmed that local congregations of Jehovah’s Witnesses maintained a “manual filing system” containing the names and addresses of people who wished not to be visited by Jehovah’s Witnesses, and argued that those data subjects voluntarily and consciously “approve[d] the collection of their data by virtue of the fact that they ask[ed] not to be visited by any Jehovah’s Witnesses” and that “[t]he congregations could not comply with such a request without collecting the person’s name and address.” It was further submitted that individual Jehovah’s Witnesses were not under any obligation by the applicant community to keep records regarding the people they met. Such personal notes were not seen, obtained or retained by the applicant community or congregations and were, in principle, ultimately discarded by the individual member who made them. The applicant community or congregations maintained no lists, card indexes or directories of interested people, including deaf people and foreigners, nor were any such data retrievable. As regards form S-43, it was explained that the congregation acted as “an informal mailing system” in that “a congregation elder forward[ed] an individual’s personal notes on form S-43 to another individual Jehovah’s Witness. The congregation elder and the [applicant community] [did] not retain copies of the information or use the personal data in any way ... The form [was] either sent directly by the contacting Witness or through a congregation elder.” Proceedings before the Data Protection Board 6 .     On 3 April 2013 the Ombudsman submitted an application to the Data Protection Board ( tietosuojalautakunta, datasekretessnämnden – “the Board”), requesting it to prohibit the applicant community, within an appropriate time-limit and on pain of a fine, from collecting and otherwise processing personal data in the course of its door-to-door preaching, as well as data on foreigners and deaf people, without the consent of those in question. Moreover, the Ombudsman requested that the Board order the applicant community on pain of a fine to give instructions to its congregations and individual Jehovah’s Witnesses regarding the need to obtain consent to collect and process personal data in the course of door-to-door preaching. The Ombudsman claimed that the applicant community acted as a “controller” within the meaning of the Personal Data Act (see paragraph 32 below) regarding the notes and contact information about data subjects collected by individual Jehovah’s Witnesses in connection with their door-to-door preaching. As this was not a case where personal data were being processed for purely personal purposes or for comparable ordinary and private purposes, the Personal Data Act applied to the processing of the personal data in question. Furthermore, given the absence of any membership or other pertinent relationship within the meaning of sections 8 and 12 of the Personal Data Act between data subjects and the applicant community (see paragraphs 33 and 35 below), the collection and processing of the personal data in question always required the consent of the people in question. 7 .     In its submissions in reply of 12 June 2013, the applicant community argued that it could not be regarded as a “controller” as it had no access, control or other authority over private notes made by individual Jehovah’s Witnesses. Form S-43 (known as the “Please Follow Up” form) issued by the applicant community and forwarded by someone holding office in a congregation (a congregation secretary) with a view to securing an individual Jehovah’s Witness with appropriate skills (for foreigners and people using sign language) was a “referral note to facilitate contact” which was subsequently destroyed; it was not an automatic processing of data, and the data did not constitute and were not intended to constitute a personal data file. The Personal Data Act did not apply to door-to-door preaching by individual Witnesses because the notes taken during such visits, which were to be seen in the context of freedom of religion, were made solely for personal and private purposes. They helped individual Jehovah’s Witnesses to remember, inter alia , the topic discussed and questions he or she had promised to answer during the next visit, or simply to take into consideration the feelings and wishes of the person visited so that the same Witness would not visit him or her too often. 8 .     On 17 September 2013 the Board rendered a decision which, as stated therein, pertained to the lawfulness of processing personal data in connection with door-to-door preaching and not door-to-door preaching per se . The Board prohibited the applicant community from collecting and processing personal data in connection with door-to-door preaching without meeting the general prerequisites for processing personal and sensitive data specified in sections 8 and 12 of the Personal Data Act respectively, that is, without the unambiguous consent of the data subject. The Board noted that the definition of personal data was broad. According to the Board, when names, addresses and other personal information were noted down in connection with door ‑ to ‑ door preaching by Jehovah’s Witnesses that served, as argued by the applicant community, as a memory aid when revisiting people who had shown interest, personal data that could be retrieved were being collected. When, for example, a data subject’s religious affiliation or state of health was noted down, sensitive data were being collected. 9 .     The Board further noted that the definition of a personal data file was also broad. Such a file was created when data about a particular person were sorted so that they could be retrieved easily. Information about individuals using a foreign language or sign language (personal name, gender, address, telephone number and language of the person who had shown interest) collected by means of form S-43 facilitated the retrieval and transfer of data concerning a certain person and resulted in the creation of personal data files. 10 .     The Board took note of the leaflet entitled “Our Kingdom Ministry” (adduced in evidence by the Ombudsman, see paragraph 5 above) published by the applicant community proposing what might be recorded in personal notes, namely the name and address of the person concerned, as well as information relating to his or her religious affiliation and family. Although individual Jehovah’s Witnesses could decide whether or not they would take notes and what their content would be, the information in question “was collected for the activity of the community and in accordance with its guidelines”. The Board held that taking notes in connection with that activity could not be viewed as processing personal data for personal purposes or for comparable ordinary and private purposes, but to fulfil the purposes of the applicant community as a religious association. Furthermore, on the basis of information provided by the Ombudsman, the Board established that door ‑ to ‑ door preaching was carried out by “territory” and that, consequently, notes were likewise sorted by territory. Therefore, the applicant community and its members who collected data were regarded as controllers within the meaning of the Personal Data Act, as in the definition of a controller it was not essential who stored the data. 11 .     The Board ordered the applicant community to ensure, within six months, that no personal data were collected for its purposes without the prerequisites for processing such data being met. The Board did not deem it necessary to impose a fine in the matter. Proceedings before the Administrative Court 12 .     On 17 October 2013 the applicant community and two individual Jehovah’s Witnesses appealed against the Board’s decision to the Helsinki Administrative Court ( hallinto-oikeus, förvaltningsdomstolen – “the Administrative Court”). Reiterating the applicant community’s arguments (see paragraph 7 above), the appellants requested the court to amend the Board’s decision so that it would not regard the applicant community or its individual members as “controllers” and would consider the private notes taken by individual Jehovah’s Witnesses in connection with their door ‑ to ‑ door preaching to have been made for “personal purposes or for comparable ordinary and private purposes only”. According to the applicant community, the private notes were not made on its behalf and “serve[d] solely as a memory aid when revisiting those who show[ed] interest.” It was argued that “the [applicant community] encourage[d] Witnesses to have a share in ‘telling the good news’ ... and [that] it ... ma[d]e practical recommendations as to how the individual [might] make use of his religious freedom in an effective way to the benefit of interested listeners”. The appellants contested the Board’s findings that the information in question was collected by Jehovah’s Witnesses for purposes related to “the activity of the community and in accordance with its guidelines” as it presupposed an appropriate legal basis, namely a contractual or membership relationship between individual Witnesses and the applicant community. The former (contractual relationship) did not exist and the latter (membership) was “determined by the religious confession of Jehovah’s Witnesses and [the applicant community’s] inner membership structure, which [was] protected under Article 11 of the [Convention]”. Furthermore, the leaflet referred to in the Board’s decision was the same in all countries and was of a general nature “giving some suggestions only”. The appellants also requested that an oral hearing be held in the course of the proceedings “in order to enable [the applicant community] to present evidence on the private nature of the notes, as well as to provide evidence for [it] not falling within the scope of the definition of ‘controller’ within the meaning of section 3(4) of [the] Personal Data Act (523/1999) and Article 2(d) of Directive 95/46/EC”. In further submissions, the appellants argued that an oral hearing was decisive in order to supplement the reasoning presented in the written documents. The applicant community further informed the court that it had decided to stop using form S-43. Moreover, the appellants asked that the court request the Court of Justice of the European Union (CJEU) to give a preliminary ruling on Directive 95/46/EC of the European Parliament and of the Council of 24   October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L   281, p.   31 – hereinafter “the Data Protection Directive”). Lastly, the appellants argued that the result of upholding the Board’s decision “would be that individual Jehovah’s Witnesses would have no choice other than to witness in a disorganised manner, by contacting and visiting people randomly and, unintentionally, repeatedly”, the effect of which “would impinge upon the personal autonomy and freedom of individuals who [did] not wish to be excessively disturbed (Article 8 of the [Convention]). [That] would also run counter to the aim of Jehovah’s Witnesses, who want[ed] to share the message of the Gospel in a peaceful, respectful and orderly manner (Article   9 of the [Convention]).” 13 .     On 18 December 2014 a three-judge panel of the Helsinki Administrative Court dismissed the appeal without examining the merits with regard to the two individual Jehovah’s Witnesses on the grounds that the Board’s decision had not been addressed to them and could not be considered to directly affect their rights, obligations or interests. It rejected the part of the appeal pertaining to the prohibition of the use of form S-43 (see paragraph 9 above) for people using a foreign language or sign language, which the applicant community had meanwhile withdrawn. It also rejected the request for a preliminary ruling from the CJEU. As regards the request for an oral hearing, the court referred to the relevant statutory provisions (see paragraph 38 below) and noted that an oral hearing would not be held if the claim was dismissed without considering its merits, or if it was rejected or if an oral hearing was manifestly unnecessary in view of the nature of the matter or for other reasons. In the present case, it held that an oral hearing was manifestly unnecessary in view of the outcome of the case. 14 .     As regards the merits of the case, the court firstly noted that the Personal Data Act had transposed the Data Protection Directive into Finnish law. It further found it established that door-to-door preaching was carried out as part of the activities of the applicant community and was a manifestation of the belief of its individual members. Referring to the instructions contained in the leaflet issued by the applicant community, the court held that in the course of its preaching activities, individual members could engage in collecting data regarding people who were outside of the applicant community and unknown to its members. The collection of such data could not be considered the processing of personal data for purely personal purposes or for comparable ordinary and private purposes within the meaning of section 2(3) of the Personal Data Act (see paragraph 31 below). Accordingly, the express and explicit consent of the person concerned was required for the collection and processing of such data. Notwithstanding the above, the court held that the applicant community could not be regarded as a “controller” within the meaning of section 3(4) of the Personal Data Act (see paragraph 32 below) solely on the grounds that it had given instructions in its leaflet to its members regarding the unlawful processing of personal data. According to the court, it had not been shown that the data possibly collected by individual members would constitute a personal file for the use of the applicant community over which it exercised any authority. Accordingly, it allowed the appeal and annulled the relevant part of the Board’s decision. Proceedings before the Supreme Administrative Court The parties’ submissions 15.     On 16 January 2015 the Ombudsman appealed against the Administrative Court’s decision to the Supreme Administrative Court ( korkein hallinto-oikeus, högsta förvaltningsdomstolen ), requesting it to quash the Administrative Court’s decision in so far as it had allowed the applicant community’s appeal. The Ombudsman argued that the applicant community had to be regarded as a “controller” of the notes taken by its individual members in connection with door-to-door preaching. In the Ombudsman’s opinion, the applicant community had “significantly determined the purpose and means for the processing of personal data”. Since “the making of personal notes in the course of door-to-door preaching [was] an activity carefully instructed and organised by the [applicant community] and carried out by individual Jehovah’s Witnesses”, it had to be regarded as a “controller” within the meaning of the Personal Data Act. That was the case even if the personal notes made in connection with visits or part thereof were in the possession of individual Jehovah’s Witnesses. This was because the applicant community had actual authority to collect and process the data. It was further reiterated that the congregations kept territory cards on the basis of which preaching territories were allocated to individual Jehovah’s Witnesses. 16 .     On 20 April 2015 the applicant community filed its submissions in reply to the Supreme Administrative Court. It was argued that any notes (no example of such a note was produced in evidence) ostensibly made by individual Jehovah’s Witnesses in the exercise of their individual religious conscience served as a memory aid and fell outside the scope of the Personal Data Act. The applicant community confirmed that some Jehovah’s Witnesses might choose to make a brief informal personal note following a conversation, which was of a private nature. Such notes were not disclosed to anyone else. There was no form, no file and no automatic or systematic structure for maintaining or retrieving that information, which was ultimately destroyed. Furthermore, the applicant community did not order or direct individual Jehovah’s Witnesses to participate in evangelism. It was a legal entity, the sole purpose of which was to facilitate the religious worship of Jehovah’s Witnesses, such as by renting or building places of worship or importing and producing religious literature. It further did not check, verify, direct, control, restrain or regulate the private notes that individual Jehovah’s Witnesses might choose to make in the course of their door-to-door preaching. The applicant community further argued that there was no “reasonable expectation of privacy” that would attract the applicability of Article 8 of the Convention since the information allegedly in the notes was either publicly available (telephone directories or publicly accessible lists in all residential apartment buildings of residents’ names and apartment numbers) or voluntarily disclosed by data subjects (during conversations). In contrast, requiring individual Jehovah’s Witnesses to obtain explicit consent under the Personal Data Act before making any personal “notes” would have a “chilling effect” on freedom of religion and expression contrary to Articles   9 and 10 of the Convention. Lastly, the applicant community complained under Article 14, read in conjunction with Articles 9 and 10 of the Convention, that “the application of the Personal Data Act, and section 8(1) in particular, to the religious preaching of individual Jehovah’s Witnesses” would violate the prohibition on discrimination since a similar requirement was not imposed on other private discussions between citizens (conversations with friends, family and even brief acquaintances). The Personal Data Act did not apply to the exchange of their contact information. Furthermore, there was no “objective and reasonable” justification for exempting “journalism or artistic or literary expression”, as provided for in section 2(5) of the Personal Data Act (see paragraph 31 above) but not also “religious expression and, in particular, the brief private notes made by individual Jehovah’s Witnesses in furtherance of their religious preaching”. Request for a preliminary ruling by the Court of Justice of the European Union 17 .     On 22 December 2016 the Supreme Administrative Court decided to adjourn the proceedings and request a preliminary ruling from the CJEU concerning the issue of whether the applicant community should be considered a “controller” of the personal data collected and processed by its members in the course of their door-to-door preaching within the meaning of the Data Protection Directive (see paragraph 40 below). Reference was made, inter alia , to the fact that the applicant community and its congregations maintained territory maps for the purpose of dividing territories between members participating in door-to-door preaching, as well as a so-called “prohibition register”, which was a record of people who had requested not to be visited by members taking part in that activity. 18 .     In written submissions to the CJEU, the applicant community argued that the principal facts in the case were in dispute and that the Ombudsman’s allegations were not supported by any concrete evidence. Furthermore, no individual Jehovah’s Witnesses had been interviewed or allowed to take part in the proceedings. It further reiterated its earlier arguments about the personal nature of the notes and the reasons why it could not be regarded as a “controller”. A territory map aimed to enable “orderly contact with residents in the community”. The congregations divided their geographic area into “territory maps”, but congregation members were free to choose any available territory map convenient for their individual door-to door preaching. “The territory map [was] usually a simple photocopy of a few city blocks from a public municipal map” and “contained no personal data”. 19 .     Following an oral hearing held on 28 November 2017, the Grand Chamber of the CJEU delivered its judgment on 10 July 2018 in Jehovan todistajat (C-25/17, EU:C:2018:551). As regards the applicant community’s arguments concerning the facts of the case and its request to reopen the oral phase of those proceedings, the CJEU held as follows: “27.     ... Furthermore, that party and the other interested parties ... submitted, both during the written phase and the oral phase of the proceedings, their observations concerning the interpretation of Article 2(c) and (d), and Article 3 of Directive 95/46, read in the light of Article 10 of the Charter [of Fundamental Rights of the European Union] ... 28.     As regards the facts in the main proceedings, it must be recalled that in proceedings under Article 267 TFEU, only the court making the reference may define the factual context in which the questions which it asks arise or, at very least, explain the factual assumptions on which the questions are based. It follows that a party to the main proceedings cannot allege that certain factual premisses on which the arguments advanced by the other interested parties referred to in Article 23 of the Statute of the Court of Justice of the European Union are based, or the analysis of the Advocate General, are incorrect in order to justify the reopening of the oral procedure, on the basis of Article 83 of the Rules of Procedure (see, to that effect, judgment of 26 June 2008, Burda, C-284/06, EU:C:2008:365, paragraphs 44, 45 and 47) ... 29.     ... the Court ... considers that it has all the evidence necessary to enable it to reply to the questions referred and that the present case does not thereby fall to be decided on the basis of an argument which has not been debated between the parties. The request to reopen the oral procedure must therefore be rejected. ... 32.     In the present case, the order for reference contains sufficient factual and legal information to understand both the questions referred for a preliminary ruling and their scope. Further, and most importantly, nothing in the file leads to the conclusion that the interpretation requested of EU law is unrelated to the actual facts of the main action or its object, or that the problem is hypothetical, in particular on account of the fact that the members of the Jehovah’s Witnesses Community whose collection of personal data is the basis for the questions referred are not parties to the main proceedings.” 20 .     As regards the nature of personal data processing in the context of door-to-door preaching, the CJEU stated: “35.     In order to answer that question, it should be observed from the outset, as is clear from Article 1(1) and recital 10 of Directive 95/46, that that directive seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data ... 37.     However, Article 3(2) lays down two exceptions to the scope of application of that directive which must be strictly interpreted ... 39.     In the present case, the collection of personal data by members of the Jehovah’s Witnesses Community in the course of door-to-door preaching is a religious procedure carried out by individuals. It follows that such activity is not an activity of the State authorities and cannot therefore be treated in the same way as the activities referred to in Article 3(2), first indent, of Directive 95/46. ... 41.     The words ‘personal or household’, within the meaning of [Article 3(2), second indent, of Directive 95/46], refer to the activity of the person processing the personal data and not to the person whose data are processed (see, to that effect, judgment of 11   December 2014, Rynes, C-212/13, EU:C:2014:2428, paragraphs 31 and 33). 42.     As the Court held, Article 3(2), second indent, of Directive 95/46 must be interpreted as covering only activities that are carried out in the context of the private or family life of individuals. In that connection, an activity cannot be regarded as being purely personal or domestic where its purpose is to make the data collected accessible to an unrestricted number of people or where that activity extends, even partially, to a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner ... 44.     In that connection, it is clear from the order for reference that door-to-door preaching, in the course of which personal data are collected by members of the Jehovah’s Witnesses Community, is, by its very nature, intended to spread the faith of the Jehovah’s Witnesses Community among people who, as the Advocate General observed in point 40 of his Opinion, do not belong to the faith of the members who engage in preaching. Therefore, that activity is directed outwards from the private setting of the members who engage in preaching. 45.     Furthermore, it is also clear from the order for reference that some of the data collected by the members of that community who engage in preaching are sent by them to the congregations of that community which compile lists from that data of persons who no longer wish to receive visits from those members. Thus, in the course of their preaching, those members make at least some of the data collected accessible to a potentially unlimited number of persons. ... 49.     However, although the door-to-door preaching activities of the member of a religious community is thereby protected by Article 10(1) of the Charter [of Fundamental Rights of the European Union] as an expression of the faith of those preachers, that fact does not confer an exclusively personal or household character on that activity, within the meaning of Article 3(2), second indent, of Directive 95/46. 50.     Taking account of the considerations set out in paragraphs 44 and 45 of the present judgment, the preaching extends beyond the private sphere of a member of a religious community who is a preacher. 51.     Having regard to the foregoing considerations ... Article 3(2) of Directive 95/46 ... read in the light of Article 10(1) of the Charter [of Fundamental Rights of the European Union], must be interpreted as meaning that the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data does not constitute either the processing of personal data for the purpose of activities referred to in Article 3(2), first indent, of that directive or processing of personal data carried out by a natural person in the course of a purely personal or household activity, within the meaning of Article 3(2), second indent, thereof.” 21 .     As to whether personal data processing in relation to door-to-door preaching was tantamount to a “filing system” within the meaning of the Data Protection Directive, the CJEU stated: “59.     In the present case, it is clear from the findings of the referring court that the data collected in the course of the door-to-door preaching at issue in the main proceedings are collected as a memory aid, on the basis of an allocation by geographical sector, in order to facilitate the organisation of subsequent visits to persons who have already been contacted. They include not only information relating to the content of conversations concerning the beliefs of the person contacted, but also his name and address. Furthermore, those data, or at least a part of them, are used to draw up lists kept by the congregations of the Jehovah’s Witnesses Community of persons who no longer wish to receive visits by members who engage in the preaching of that community. 60.     Thus, it appears that the personal data collected in the course of the door ‑ to ‑ door preaching at issue in the main proceedings are structured according to criteria chosen in accordance with the objective pursued by that collection, which is to prepare for subsequent visits and to keep lists of persons who no longer wish to be contacted. Thus, as it is apparent from the order for reference, those criteria, among which are the name and address of persons contacted, their beliefs or their wish not to receive further visits, are chosen so that they enable data relating to specific persons to be easily retrieved. 61.     In that connection, the specific criterion and the specific form in which the set of personal data collected by each of the members who engage in preaching is actually structured is irrelevant, so long as that set of data makes it possible for the data relating to a specific person who has been contacted to be easily retrieved, which is however for the referring court to ascertain in the light of all the circumstances of the case in the main proceedings. 62.     Therefore, ... Article 2(c) of Directive 95/46 must be interpreted as meaning that the concept of a ‘filing system’, referred to by that provision, covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use. In order for such a set of data to fall within that concept, it is not necessary that they include data sheets, specific lists or other search methods.” 22 .     As to whether a religious community (Jehovah’s Witnesses) could be regarded as a “controller” within the meaning of the Data Protection Directive, the CJEU stated: “66.     ... the existence of joint responsibility does not necessarily imply equal responsibility of the various operators engaged in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, so that the level of responsibility of each of them must be assessed with regard to all the relevant circumstances of the particular case ... 70.     In the present case, as is clear from the order for reference, it is true that members of the Jehovah’s Witnesses Community who engage in preaching determine in which specific circumstances they collect personal data relating to persons visited, which specific data are collected and how those data are subsequently processed. However, as set out in paragraphs 43 and 44 of the present judgment, the collection of personal data is earned out in the course of door-to-door preaching, by which members of the Jehovah’s Witnesses Community who engage in preaching spread the faith of their community. That preaching activity is, as is apparent from the order for reference, organised, coordinated and encouraged by that community. In that context, the data are collected as a memory aid for later use and for a possible subsequent visit. Finally, the congregations of the Jehovah’s Witnesses Community keep lists of persons who no longer wish to receive a visit, from those data which are transmitted to them by members who engage in preaching. 71.     Thus, it appears that the collection of personal data relating to persons contacted and their subsequent processing help to achieve the objective of the Jehovah’s Witnesses Community, which is to spread its faith and are, therefore, carried out by members who engage in preaching for the purposes of that community. Furthermore, not only does the Jehovah’s Witnesses Community have knowledge on a general level of the fact that such processing is carried out in order to spread its faith, but that community organises and coordinates the preaching activities of its members, in particular, by allocating areas of activity between the various members who engage in preaching. 72.     Such circumstances lead to the conclusion that the Jehovah’s Witnesses Community encourages its members who engage in preaching to carry out data processing in the context of their preaching activity. 73.     In the light of the file submitted to the Court, it appears that the Jehovah’s Witnesses Community, by organising, coordinating and encouraging the preaching activities of its members intended to spread its faith, participates, jointly with its members who engage in preaching, in determining the purposes and means of processing of personal data of the persons contacted, which is, however, for the referring court to verify with regard to all of the circumstances of the case. 75.     Having regard to the foregoing considerations, ... Article 2(d) of Directive 95/46, read in the light of Article 10(1) of the Charter [of Fundamental Rights of the European Union], must be interpreted as meaning that it supports the finding that a religious community is a controller, jointly with its members who engage in preaching, for the processing of personal data carried out by the latter in the context of door-to ‑ door preaching organised, coordinated and encouraged by that community, without it being necessary that the community has access to those data, or to establish that that community has given its members written guidelines or instructions in relation to the data processing.” Judgment of the Supreme Administrative Court 23 .     On 20 September 2018 the applicant community filed its further submissions with the Supreme Administrative Court, requesting, inter alia , that an oral hearing be held before that court. According to the applicant community, an oral hearing was necessary because the Data Protection Directive had been replaced by the General Data Protection Regulation (see paragraph 41 below) and the relevant factual issues “ha[d] not been answered by the CJEU’s preliminary ruling” (reference was made to paragraphs 44, 62 and 73 of the CJEU’s judgment). In this connection, the applicant community requested that an expert in religious matters (whose personal details were provided) and twenty-four individual Jehovah’s Witnesses be called to give evidence in court. A summary of their written statements was also submitted in support. It was further argued that the Board’s 2013 order (see paragraph 8 above) “violate[d] the rights of individual Jehovah’s Witnesses contrary to Articles 8, 9, 10 taken alone and in conjunction with Article 14 of the Convention and Article 1 of Protocol No. 12 to the Convention.” In this connection, the applicant community argued that “although comparable to activities which benefit[ed] from exemptions or derogations under [section] 2(5) of the Personal Data Act”, the door-to-door preaching activity of Jehovah’s Witnesses had “received less favourable treatment ... without ‘any objective and reasonable justification’”. 24 .     In a decision of 17 December 2018, which ran to sixty-seven pages and contained a detailed description of the parties’ submissions and the earlier decisions, the Supreme Administrative Court stressed that the decision of the Board only concerned the applicant community and that it would not rule on whether individual Jehovah’s Witnesses separately should be considered as controllers. The court quashed the Administrative Court’s decision in so far as it had annulled the Board’s decision, thereby bringing the latter into force. Referring to section 39 of the Administrative Judicial Procedure Act (see paragraph 38 below), the court rejected the applicant community’s request for an oral hearing since all twenty-four witnesses had already submitted their testimony in writing, which, as stated in the judgment, “ha[d] been taken into consideration when making the decision”. 25 .     As to the merits, the court, referring to the applicant community’s submissions and the witnesses’ written statements (some of whom confirmed that they made a brief note containing personal data in connection with a return visit or Bible study using an application on their electronic mobile device or using a paper notebook), noted that the content of the notes that individual Jehovah’s Witnesses might take during their door-to-door preaching varied according to the practices they adopted and the various situations they encountered in their preaching work. The notes could include the house number, the resident’s surname, if a certain address or resident at a certain address should not be visited again, and, in the case of return visits, a person’s first and/or last name, gender, address (possibly without the resident’s name or gender) or other contact details, the possible date of the next agreed visit and the possible topic of future discussion. Therefore, a significant part of the notes of individual Jehovah’s Witnesses could indisputably be considered personal data as defined in the Personal Data Act and could include sensitive data. 26.     Referring to the above-mentioned findings of the CJEU, the court held that the collection of personal data by individual Jehovah’s Witnesses during their door-to-door preaching and the subsequent processing thereof could not be regarded as falling under the notion of processing of personal data which a private individual carried out for purely personal purposes or for comparable ordinary and private purposes. The fact that some individual Jehovah’s Witnesses might create friendships or acquaintanceships with some of the individuals whose personal data were in their notes, or that part of the personal data collected could be available from public sources, was immaterial. The court held it established that making notes containing personal data was related to the preparation of upcoming door-to-door preaching visits. Even though the methods and techniques used by each individual Jehovah’s Witness to record and organise personal data might differ, it stated that it would not make sense to take notes if, at the same time, the data were not being organised in such a manner to allow them to be found easily. Therefore, notes containing personal data in the form of paper documents or in electronic form on a mobile device (see paragraph 25 above) formed a personal data file, which meant that the Personal Data Act applied to the processing of such data. 27 .     The Supreme Administrative Court further noted that the making of notes containing personal data was significantly linked to door-to-door preaching for the purpose of spreading one’s faith. Referring to the findings of the CJEU as to wh