As we all know, there’s no better way to start your day than opening your front door to beaming Jehovah’s Witness preachers. But in Finland patience has been stretched a little.

Background to the Case

In 2013, the Finnish Data Protection Agency (DPA) took the Jehovah’s Witnesses to court for data privacy infringements. They objected to preachers going door to door and collecting personal data without consent. They even banned them from doing so for six months unless they upped their game. The DPA bumped the case up to the European Court of Justice (CJEU) and a ruling was made on July 10th, 2018.

The Jehovah’s Witnesses church has communities all over the world. In Finland, as elsewhere, members venture into the wider community to share their faith. They knock on doors and ask questions.

The DPA respects religious freedoms but forbids the collection of personal data without consent. It argued the church was breaking EU law. Jehovah’s Witnesses insisted any data collection was informal.

CJEU Ruling

The CJEU ruled on July 10th that Jehovah’s Witnesses must respect EU law on data protection. The preachers are controllers, partly because they're targeting people outside their religious circle. Further, the CJEU insisted members of the church's back office are joint controllers. They use the preachers’ data to organise and coordinate home visits.

As always, the press release is a little more readable than the full judgement (assuming you’re not a qualified lawyer). At the top is the paragraph which sums it up best.

“A religious community, such as the Jehovah’s Witnesses, is a controller, jointly with its members who engage in preaching, for the processing of personal data carried out by the latter in the context of door-to-door preaching.”

This judgement affects all legal entities whether a church or a business. The repercussions are huge. The Processor is dead. There are now only Controllers of data.

Repercussions 

For Finnish Jehovah’s Witnesses to continue preaching, they must first ask consent from the person answering the door.

In the CJEU’s judgement the activity of the preachers is not a “…purely personal or household activity to which that law does not apply.” Neither is knocking on doors and waking the occupiers “…an expression of faith of those preachers.”

Thus, no exemption can be made for the denomination which exempts itself from military service and blood transfusions.

Wider Implications

Neither could the CJEU make an exemption for jotting down notes on a pad. EU law states that even manually processed data when stored defines a filing system. Data does not have to be electronically stored in a series of databases to comply with EU law.

The case now returns to the Finnish Supreme Court with a ruling expected later this year.

In summary, the important point for processors is that a natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller.  Of significance is the phrase for his own purposes – which essentially means any organisation that determines the purposes and means of processing for their own ends is a controller.

The processor is dead – long live the controller!

Further Reading

Jehovah's Witnesses must ask permission before collecting personal data on the doorstep, by Olivia Rudgard, 15 July 2018

EU Court: Jehovah’s Witnesses door-to-door preaching does not comply with data protection laws, by Evangelical Focus, 12 July 2018

EU Court: Jehovah’s Witnesses must comply with data privacy law, by Vento, 11 July 2018 

Back To all catagories