> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Jehovan: When Door-to-Door Notes Create Joint Control
- URL: https://www.thedelatorrereview.com/jehovan-when-door-to-door-notes-create-joint-control/
- Published: 2018-06-10T14:44:00.000Z
- Updated: 2026-10-19T06:33:38.000Z
- Description: Handwritten notes can bring organized outreach within EU data protection law. In Jehovan, the CJEU explained why religious preaching was not a purely personal activity, when informal notes become a filing system, and how an organization can be a joint controller without seeing the data.
- Author: Lydia
- Tags: Court of Justice of the European Union (CJEU), Caselaw, Controller, Joint Controllers, Data Protection Directive, Directive 95/46/EC, Special/Sensitive Category Data

**Case C-25/17 | Tietosuojavaltuutettu, intervening party Jehovan todistajat — uskonnollinen yhdyskunta | Court of Justice of the European Union | Grand Chamber | 10 July 2018**

> **Practice Takeaways:** **①** Personal motivation does not establish the **household exemption**. Organized outreach to people outside the preacher’s private circle falls beyond it. **② Paper records can count.** Notes structured to permit easy retrieval of information about particular people can constitute a filing system. **③ Access is not essential to control.** An organization can jointly determine processing without receiving the underlying records. **④ Written instructions are not required.** Actual influence over the purposes and means matters. **⑤ Joint responsibility need not be equal.** Each participant’s role must be assessed in context. **⑥ Religious freedom does not create a general exemption** from data protection law.

**Can notes taken during a religious visit be treated as a private memory aid?** And can the religious community organizing those visits be responsible for processing records that remain with individual members?

In Jehovan, the Court **rejected an approach that would place the processing outside data protection law simply because the notes were informal, decentralized, or connected to religious practice.** It also explained that a community organizing, coordinating, and encouraging the relevant activities could be a controller jointly with the members collecting the data.

The judgment interpreted Directive 95/46, the GDPR’s predecessor. Its analysis remains relevant to the GDPR’s corresponding provisions on the household exemption, filing systems, and controllers. (GDPR, Articles [2(1), 2(2)(c)](https://gdpr-info.eu/art-2-gdpr/?ref=thedelatorrereview.com), and [4(6)–(7)](https://gdpr-info.eu/art-4-gdpr/?ref=thedelatorrereview.com).)

> **Practice Tip:** When assessing responsibility for decentralized collection, look beyond who holds the notebook. Ask who shapes the activity, why the information is collected, and how it will be used.

## **What happened**

Members of Finland’s Jehovah’s Witnesses community took n**otes during door-to-door preaching**. According to the referring court, the notes could contain **names, addresses, religious beliefs, and family circumstances**. They were collected without the individuals’ knowledge or consent as **memory aids for subsequent visits**. (Judgment, para. 15.)

The community and its **congregations organized the preaching, allocated geographical areas, and** **maintained lists of people who did not want further visits** (called the *‘refusal register’* **)**. The referring court also described **published guidance on note taking and forms** previously supplied to members. The community maintained that it did not require collection and did not know the contents of members’ informal notes. (Judgment, paras. 16–17.)

In September 2013, Finland’s Data Protection Board prohibited collection and processing unless Finnish legal requirements were satisfied. It considered the community and its members to be controllers. The community successfully challenged that decision before the Helsinki Administrative Court; the Data Protection Supervisor appealed to the Supreme Administrative Court. (Judgment, paras. 11–14.)

That court asked the CJEU whether the processing fell within the Directive, whether the notes constituted a filing system, and whether the community could be a controller without access to the data or written instructions directing collection. (Judgment, para. 24.)

## **Why the case matters**

Jehovan addresses two ways responsibility might otherwise disappear: treating organized outreach as private activity, and treating an organization’s lack of access to locally held records as proof that it is not a controller.

The Court’s approach **examines how the activity actually works**. 

---

> **Neither religious motivation nor informal recordkeeping settles whether the law applies. Neither physical possession nor a written instruction settles who controls the processing.**

---

For practitioners, this makes the case useful when reviewing decentralized outreach and recordkeeping. The relevant questions concern the activity’s reach, the records’ organization, and each participant’s influence over the processing.

## **Key holding**

The Court reached three principal conclusions:

1. **The processing was not exempt.** Collecting and subsequently processing personal data during the door-to-door preaching at issue was neither a State activity covered by the relevant exclusion nor a purely personal or household activity. (Judgment, para. 51.)
2. **Informal notes can form a filing system.** A set of personal data falls within that concept if structured according to criteria that enable easy retrieval for subsequent use. Standardized data sheets, specific lists, or another formal search method are unnecessary. (Judgment, para. 62.)
3. **The community could be a joint controller.** Organizing, coordinating, and encouraging the preaching supported that classification without requiring access to the data or proof of written processing instructions. The national court had to verify the circumstances. (Judgment, paras. 73–75.)

## **The Court’s analysis**

### **1\. Religious outreach was not a purely personal or household activity**

The Directive’s **exclusions had to be interpreted strictly.** The exclusion concerning certain State activities did not cover religious preaching by individuals. (Judgment, paras. 37–39.)

- The household exemption likewise concerned the private or family life of the person processing the data. It did not turn on whether the person being visited was at home. (Judgment, paras. 40–42.)
- The preaching sought to spread the community’s faith among people outside it. That activity extended beyond the preachers’ private sphere. Some information also reached congregations for use in lists of people refusing further visits. (Judgment, paras. 44–45, 50.)

---

> **" \[...\] the collection of personal data by members of a religious community in the course of door-to-door preaching and the subsequent processing of those data does not constitute \[...\] processing \[...\] in the course of a purely personal or household activity \[...\]** (Judgment, para. 51.)

---

**The Court recognized that freedom of religion protects preaching.** But protection under Article 10(1) of the Charter did not make the associated processing purely personal or household. (Judgment, paras. 46–49.)

> **Practice Tip:** Assess the household exemption from the perspective of the person processing the data. Entering someone else’s home, acting voluntarily, or following a personal religious commitment does not by itself make organized outreach a household activity.

### **2\. A filing system does not require standardized forms**

For nonautomated processing, the Directive applied where personal data formed, or were intended to form, part of a **filing system** (See, [What is a ‘filing system’ under the GDPR?](https://www.thedelatorrereview.com/what-is-a-filing-system-under-the/)). **Protection could not depend on the technology used, but genuinely unstructured manual records fell outside that definition.** (Judgment, paras. 53–55.)

- The test was practical: **were the data structured according to criteria that made information about particular people easily accessible?** The Directive did not prescribe the arrangement or require data sheets, specific lists, or a particular search tool. A filing system could also be decentralized or geographically dispersed. (Judgment, paras. 56–58.)

Here, the notes supported return visits and the maintenance of refusal lists. Names, addresses, beliefs, and wishes about further contact could provide the criteria for retrieving information. **The precise format was immaterial if information about a particular person could easily be retrieved.** Whether that condition was met was for the national court to establish. (Judgment, paras. 59–62.)

> **Practice Tip:** Include relevant paper records in scope assessments. A notebook organized for retrieving information about particular contacts may qualify even without a central database or standard form. The judgment does not bring every loose handwritten note within the law.

### **3\. Joint control does not require access to the data**

The definition of **controller covers those who determine purposes and means alone or jointly with others** (See, [What is a controller?](https://www.thedelatorrereview.com/what-is-a-controller/) and [What are ‘joint controllers’ (a.k.a. ‘co-controllers’)?](https://www.thedelatorrereview.com/what-are-joint-controllers-a-k-a-co-controllers/)). Its breadth serves effective protection of individuals. (Judgment, paras. 65–66.)

The Court explained that a person or organization influencing processing for its own purposes and participating in determining its purposes and means may be a controller. **Joint control does not require every participant to have access to the personal data.** (Judgment, paras. 68–69.)

- Members decided whether and how to collect particular information. Yet collection also served the community’s objective of spreading its faith, within preaching activities it organized, coordinated, and encouraged. Those circumstances supported the community’s participation in determining the processing alongside its members. (Judgment, paras. 70–73.)

---

> **"\[...\] a natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller \[...\]"** (Judgment, para. 68)

---

The point is not that every organization becomes a controller whenever a member takes notes. **The necessary connection is participation in determining the purposes and means of the processing.**

### **4\. Written instructions are not a condition of control**

Nothing in the Directive required purposes and means to be determined through written instructions. The assessment therefore could not stop at the absence of a formal direction to collect data. (Judgment, paras. 67–68.)

- Organizing the activity, allocating territories, and encouraging processing in pursuit of the community’s objectives were relevant to the factual assessment. Written guidance could supply evidence, but proving its existence was not a prerequisite. (Judgment, paras. 70–75.)

> **Practice Tip:** Review operational arrangements alongside written policies. An organization’s practical role in shaping collection may establish control even when its documents leave individual participants discretion.

### **5\. Joint responsibility need not be equal**

The Court expressly distinguished joint responsibility from equal responsibility. **Participants may be involved at different stages and to different degrees; each participant’s responsibility must be assessed against all relevant circumstances.** (Judgment, para. 66, citing Wirtschaftsakademie.)

- Religious organizational autonomy did not displace that analysis. The obligation to comply with EU data protection rules could not itself be treated as interference with the community’s organizational autonomy. (Judgment, para. 74.)

## **The Advocate General’s Opinion**

Advocate General Paolo Mengozzi proposed substantially the same answers in his Opinion of 1 February 2018.

- **He emphasized that religious freedom must be reconciled with privacy and data protection, distinguishing preaching from the taking and transmission of notes about those visited.** Applying data protection requirements did not establish a disproportionate interference with the freedom to preach. (Opinion, paras. 44–52.)
- On filing systems, he explained that **geographical allocation and preparation for return visits could provide sufficient structure** even without sophisticated recordkeeping. (Opinion, paras. 55–59.)
- On control, he favored **factual assessment** over formal requirements. Actual influence could be demonstrated through a body of evidence; neither written instructions nor access to the data was essential. Members’ own choices could coexist with the community’s control. (Opinion, paras. 64–73.)

The Court followed that overall approach, expressly grounding its answer in joint control and preserving the national court’s role in verifying the facts.

## **What the Court did—and did not—decide**

The Court established that the **processing connected to the preaching at issue was not excluded merely because it concerned religious practice.** It explained when **manual notes can constitute a filing system** and why **access and written instructions are unnecessary** conditions for joint control.

- It did not hold that every handwritten note is a filing system, that every religious organization controls all its members’ records, or that joint controllers bear identical responsibility.
- Nor did it resolve which lawful basis or sensitive-data condition authorized particular processing. The questions concerned scope and controller status. Although the judgment described collection without knowledge or consent, that fact should not be turned into a holding that consent is invariably required for every comparable activity. (Judgment, paras. 15, 24, 51, 62, 75.)

Finally, the judgment interpreted Directive 95/46, not Article 26 GDPR. Under the GDPR, the corresponding definitions and scope rules remain relevant, while Article 26 separately requires joint controllers to allocate their compliance responsibilities through an arrangement, subject to its statutory exception. (GDPR, Articles [2, 4(6)–(7)](https://gdpr-info.eu/art-2-gdpr/?ref=thedelatorrereview.com), and [26.](https://gdpr-info.eu/art-26-gdpr/?ref=thedelatorrereview.com))

## **Conclusion**

Jehovan shows why informal, locally held records can carry organizational responsibility. The decisive questions are whether the activity extends beyond private life, whether manual records permit structured retrieval, and who participates in determining why and how the data are processed.

An organization can share control over that processing even when the notebook never reaches its office.

## Sources and Useful Reading

### Sources

CJEU judgments, Advocate General opinions, and related case materials are available through [InfoCuria](https://infocuria.curia.europa.eu/?ref=thedelatorrereview.com), the Court of Justice of the European Union’s official case-law database. The case can be located using **Case C-25/17, Tietosuojavaltuutettu, intervening party Jehovan todistajat — uskonnollinen yhdyskunta**.

- Court of Justice of the European Union, Grand Chamber, Case C-25/17, *Tietosuojavaltuutettu, intervening party Jehovan todistajat — uskonnollinen yhdyskunta*, Judgment of 10 July 2018, ECLI:EU:C:2018:551.
- Opinion of Advocate General Paolo Mengozzi, Case C-25/17, delivered 1 February 2018, ECLI:EU:C:2018:57.

**GDPR:** Regulation (EU) 2016/679, particularly Articles 2(1), 2(2)(c), 4(6)–(7), and 26\. These are the corresponding current provisions, rather than provisions interpreted in the judgment. [Read the Regulation](https://gdpr-info.eu/?ref=thedelatorrereview.com).

### **Useful reading from The de la Torre Review**

- **Google Spain: The “Right to Be Forgotten”—While the Past Remains Online** — Explains the broad, functional understanding of controller status that Jehovan draws on: responsibility follows from determining the purposes and means of the relevant processing. Google Spain concerns a search engine’s distinct processing, while Jehovan examines the participation of several actors in determining processing jointly. [Read the Article](https://www.thedelatorrereview.com/google-spain-the-right-to-be-forgotten-while-the-past-remains-online/).
- **Satakunnan & Satamedia: Public Data Is Still Personal Data** — Examines the broad scope of EU data protection law and the need to reconcile it with freedom of expression. Jehovan cites the judgment when interpreting the Directive’s scope and the household exemption, and addresses the related question of how data protection applies to religious practice. [Read the Article](https://www.thedelatorrereview.com/satakunnan-satamedia-public-data-is-still-personal-data/).
- **Nowak: When an Exam Answer Becomes Personal Data** — Explains why opinions and assessments can constitute personal data. It provides a useful companion to Jehovan’s treatment of notes about identifiable people’s beliefs and circumstances. [Read the Article](https://www.thedelatorrereview.com/nowak-when-an-exam-answer-becomes-personal-data/).
- **CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List** — Examines the right of access once processing falls within the GDPR, including when context is needed to make personal data intelligible. It complements Jehovan’s earlier questions about scope and responsibility. [Read the Article](https://www.thedelatorrereview.com/crif-when-a-copy-of-your-personal-data-requires-more-than-a-data-list/).
- **Wirtschaftsakademie: When a Facebook Page Creates Joint Control** — Establishes the joint-control principles that *Jehovan* applies to organized religious outreach. Explains why an organization can share control without accessing the underlying personal data and why each participant’s responsibility must reflect its actual role. *Jehovan* extends that analysis from platform analytics to decentralized, handwritten records. [Read the Article.](https://www.thedelatorrereview.com/wirtschaftsakademie-when-a-facebook-page-creates-joint-control/)
- **Ryneš: When Home Security Cameras Reach Beyond the Household** — Examines the narrow household exemption where home surveillance also records public space. Provides the foundation for *Jehovan*’s conclusion that activities directed beyond an individual’s private or family setting do not become purely personal or household merely because they reflect personal motivations. [Read the Article.](https://www.thedelatorrereview.com/rynes-when-home-security-cameras-reach-beyond-the-household/)
- **Puškár: When Tax Fraud Lists Meet the Right to an Effective Remedy** — Explains why exclusions from EU data protection law must be interpreted narrowly. *Jehovan* expressly cites *Puškár*, paragraph 38, for that principle when examining the Directive’s scope. Provides complementary context for why the nature or purpose of an activity does not, by itself, place its associated processing outside data protection law. [Read the Article.](https://www.thedelatorrereview.com/puskar-tax-fraud-lists-court-access-and-the-limits-of-procedural-barriers/)
- **Material Scope of the GDPR** — Explains which processing activities fall within the GDPR, including automated processing, structured manual records, and the narrow household exemption. It provides the broader framework for the scope questions examined in Jehovan. [Read the Article](https://www.thedelatorrereview.com/material-scope-of-the-gdpr/).
- **What is a ‘filing system’ under the GDPR?** — Examines when paper records are structured enough to fall within data protection law, drawing directly on Jehovan’s easy-retrieval analysis and discussing the ICO’s practical “temp test.” [Read the Article](https://www.thedelatorrereview.com/what-is-a-filing-system-under-the/).

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/10/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-19.png)