Lindqvist: When a Parish Website Became Data Processing

Case C-101/01 | Court of Justice of the European Union | Full Court | 6 November 2003

Practice takeaways: (1) Publishing information about identifiable people on a website is automated processing of personal data. (2) Public internet publication is not a purely personal or household activity merely because it is unpaid, informal, charitable, or religious. (3) Even a brief reference to an injury and medically reduced work can be health data. (4) Under Directive 95/46, making an EU-hosted webpage globally accessible was not, by itself, a third-country transfer. (5) Data protection must be applied consistently with freedom of expression and proportionality. (6) National penalties must reflect the facts and seriousness of the breach.

In Lindqvist, the Court of Justice of the European Union considered an ordinary act with extraordinary doctrinal consequences: a volunteer catechist created a small parish website and posted information about herself and 18 colleagues. The pages named people, described their work and hobbies, mentioned family circumstances and telephone numbers, and stated that one colleague had injured her foot and was working half-time on medical grounds. (Judgment, paras. 12-14.)

From those modest facts, the Court established principles that still shape EU data protection law.

A name combined with other details is personal data.

Uploading those details to a website is processing by automatic means.

Public internet publication falls outside the household exemption.

Health data must be interpreted broadly.

Data protection rules must be applied through a fair balance with freedom of expression and other fundamental rights.

The case also produced a more time-bound holding: making an EU-hosted webpage accessible worldwide was not, without more, a transfer to every third country from which the page could be viewed. That conclusion addressed the structure and technology of Directive 95/46 and caution is needed before attempting to convert it into a general rule that online publication can never involve an international transfer.

The short version

Bodil Lindqvist worked as a maintenance employee and volunteered as a catechist in the parish of Alseda, Sweden. After taking a data-processing course, she created internet pages at home to provide useful information to parishioners preparing for confirmation. At her request, the Swedish Church's website linked to the pages. (Judgment, para. 12.)

She did not inform her colleagues, obtain their consent, or notify the Swedish data protection authority. When she learned that some colleagues objected, she removed the pages. Swedish prosecutors nevertheless charged her under the Personuppgiftslag, the national law implementing Directive 95/46, for un-notified automated processing, unauthorized processing of sensitive data, and unauthorized transfer to third countries. She was fined SEK 4,000 (approximately US$421) and ordered to pay SEK 300 (approximately US$32) to a victim-support fund. (Judgment, paras. 14-17.)

On appeal, the Göta hovrätt asked the CJEU seven questions about the Directive's scope, including whether the website involved automated processing, whether an exception applied, whether the reference to the injured foot was health data, whether worldwide accessibility amounted to a third-country transfer, whether the Directive conflicted with freedom of expression, and whether Sweden could provide broader protection. (Judgment, para. 18.)

The Court answered with a broad conception of processing and a narrow household exemption. It held that the website fell within the Directive, the injury information was health data, and the national court had to apply the implementing law consistently with fundamental rights and proportionality. But it held that loading the information onto an EU-hosted webpage was not, merely because the page was globally accessible, a third-country transfer under Article 25.

Why the case matters

Lindqvist was the Court's first major decision defining the scope of Directive 95/46 in the internet context. Its lasting importance is not that the website was sophisticated; it is precisely that it was not. The Court made clear that data protection law can apply to informal publication by a private individual when personal data are made available beyond the private or family circle.

The judgment also separated several questions that are often collapsed into one another:

• Whether information is personal data depends on whether it relates to an identified or identifiable person.
• Whether an operation is processing depends on what is done with the data, including disclosure, dissemination, or making them available.
• Whether the Directive applies depends on its material scope and exceptions, including the household exemption.
• Whether particular data receive heightened protection depends on their content; a short description can still reveal health information.
• Whether publication is lawful and proportionate is a further question, informed by competing fundamental rights and the circumstances of the case.

That step-by-step structure remains useful under the GDPR, even though the governing provisions and the modern law of international transfers have evolved.

Key holding

The Court reached six connected conclusions:

• Referring to identifiable people on a webpage - by name, telephone number, working conditions, hobbies, or similar information - is processing of personal data wholly or partly by automatic means. (Judgment, paras. 24-27, operative part 1.)
• The charitable and religious nature of the activity did not bring it within the exception for State activities outside Community law, and publication to an indefinite audience was not purely personal or household activity. (Judgment, paras. 37-48, operative part 2.)
• Stating that a person had injured her foot and was working half-time on medical grounds was data concerning health, a concept requiring a wide interpretation. (Judgment, paras. 49-51, operative part 3.)
• An individual did not make a third-country transfer merely by placing data on a webpage hosted in a Member State and thereby making it accessible worldwide. (Judgment, paras. 52-71, operative part 4.)
• Directive 95/46 did not inherently conflict with freedom of expression. National authorities and courts had to ensure a fair balance among the rights and interests involved and respect proportionality, including when imposing sanctions. (Judgment, paras. 72-90, operative part 5.)
• The Directive generally accomplished complete, not merely minimum, harmonization. Member States had to remain within its framework where it applied, although they could extend national data protection law to areas outside its scope if other EU law did not prevent it. (Judgment, paras. 91-99, operative part 6.)

The Court's analysis

1. Publishing identifiable information online was automated processing

Directive 95/46 defined personal data as any information relating to an identified or identifiable natural person. The Court had little difficulty concluding that a person's name combined with a telephone number, working conditions, or hobbies fell within that definition. (Judgment, para. 24.)

The processing question was equally direct. Article 2(b) included disclosure by transmission, dissemination, or otherwise making data available. Loading personal data onto a webpage therefore qualified as processing. Because publishing the page involved loading it onto a server and making it accessible through internet infrastructure, the operations were performed at least partly automatically. (Judgment, paras. 25-26.)

Practice Tip:A simple webpage does not sit outside data protection law because it looks like ordinary communication. Publication is an operation performed on personal data, and internet infrastructure makes that operation at least partly automated.

2. The household exemption ended at public internet publication

Lindqvist argued that her activity was noncommercial and connected to charitable and religious work. The Court rejected the idea that each individual activity needed a direct link to cross-border trade before the Directive could apply. Such an approach would make the Directive's boundaries uncertain and undermine its harmonizing purpose. The State-activity exception covered the listed public-security and governmental fields, or activities in the same category - not parish volunteering. (Judgment, paras. 37-45.)

The household exception was also unavailable. The Court read it as limited to activities carried out in the course of an individual's private or family life, such as correspondence or keeping an address book. Publishing data on the internet so that they were accessible to an indefinite number of people was clearly different. (Judgment, paras. 46-48.)

The Court's reasoning turned on the audience and nature of the disclosure, not on profit. A project may be personal in motivation, created at home, unpaid, and socially valuable, yet still cease to be a personal or household activity when it publishes other people's information to an indefinite audience.

3. A foot injury was health data

The website stated that a colleague had injured her foot and was working half-time on medical grounds. The Court held that the phrase 'data concerning health' had to be interpreted widely to cover information concerning all aspects of a person's physical and mental health. The statement therefore fell within Article 8(1), which governed special categories of data. (Judgment, paras. 49-51.)

Lindqvist is a useful warning against treating health data as limited to diagnoses, medical records, or clinical detail.

Context can reveal health status through ordinary language. A workplace schedule, absence explanation, accommodation, or description of an injury may communicate protected health information even when no formal medical terminology appears.

4. Global accessibility was not automatically a third-country transfer

The transfer question required the Court to distinguish publication from transmission to a particular destination. A person outside the EU seeking the information had to connect to the internet and take steps to visit the page; the page did not automatically send the information to people who had not sought access. The data reached users through the hosting provider's infrastructure rather than through a direct transfer from Lindqvist to each viewer. (Judgment, paras. 57-61.)

The Court also examined the structure of Chapter IV of Directive 95/46. That was the chapter on cross-border transfers that created a special regime allowing Member States and the Commission to monitor transfers to particular third countries according to the protection available there. It contained no internet-specific criteria. The Court declined to presume that the legislature intended that result. (Judgment, paras. 62-70.)

Treating every web publication as a transfer to every country with internet access would convert the special transfer regime into a general prohibition on putting personal data online whenever even one accessible country lacked adequate protection.

The holding was carefully bounded. It concerned an individual who uploaded data to a page hosted by a provider established in Sweden or another Member State. The Court expressly did not decide how the hosting provider's own operations should be classified, and it said there was no need to answer the referring court's different hypothetical involving a host physically in a third country. (Judgment, paras. 52, 62, 70-71.)

5. Data protection and freedom of expression required a fair balance

The Court rejected the argument that Directive 95/46 was inherently incompatible with freedom of expression. The Directive itself contained mechanisms for balancing interests, and its flexible provisions left Member States room to implement details. But the decisive balancing had to occur when national authorities applied the implementing law to an individual case. (Judgment, paras. 79-85.)

In Lindqvist's case, that meant weighing her freedom of expression and freedom to participate in religious life against the private-life interests of the people whose data she published. National courts had to interpret domestic law consistently with the Directive, fundamental rights, and proportionality. Effective sanctions could be appropriate, but they too had to be proportionate, particularly given the Directive's wide reach and significant obligations. The duration of the breach and the importance of the disclosed data were relevant circumstances. (Judgment, paras. 86-90.)

6. Harmonization constrained national divergence

Finally, the Court described Directive 95/46 as generally complete harmonization rather than a minimum floor. Member States retained room to maneuver where the Directive authorized choices, but they had to exercise that discretion within its structure and its objective of balancing data flows with private-life protection. They could extend national data protection legislation to activities outside the Directive's scope, provided other EU law did not prevent them from doing so. (Judgment, paras. 95-99.)

The Advocate General's Opinion

Advocate General Antonio Tizzano agreed that the household exemption did not apply. In his view, only clearly private and confidential activities confined to a personal or domestic circle fell within that exception. Lindqvist's parish activity had a strong social dimension, extended beyond her private circle, and involved a page accessible to anyone through the Swedish Church website. (Opinion, paras. 33-34.)

But he would have resolved the case through the Directive's other scope exception. Because Lindqvist created the page without economic gain, as an ancillary part of voluntary catechist work and outside an employment relationship, he considered the processing to occur in an activity outside the scope of Community law. He therefore proposed that Directive 95/46 did not apply and found it unnecessary to answer the remaining questions. (Opinion, paras. 35-46.)

The Court rejected that approach. It held that the internal-market legal basis did not require proof of a direct cross-border or economic link in each individual application of the Directive. The listed exception instead concerned governmental and State-security activities, not all non-economic conduct. (Judgment, paras. 37-45.)

That disagreement is one reason Lindqvist became foundational. The Court chose a broad, stable field of application over an activity-by-activity inquiry into economic connections. At the same time, it relied on proportionality and fundamental-rights balancing to manage the breadth of the regime at the enforcement stage.

What the Court did - and did not - decide

The Court did decide that:

• ordinary names and biographical details can be personal data;
• putting personal data on a website is automated processing;
• public internet publication is not purely personal or household activity;
• a short statement about an injury and medical work status is health data;
• EU data protection rules must be applied consistently with freedom of expression and proportionality; and
• under Directive 95/46, worldwide accessibility of an EU-hosted page was not by itself a transfer to every third country.

The Court did not decide that:

• every personal website is unlawful;
• charitable, religious, or noncommercial activity is irrelevant to the ultimate proportionality analysis;
• every online reference to illness is prohibited regardless of consent, legal basis, or an applicable exception;
• internet publication can never involve a restricted international transfer;
• the location and conduct of a hosting provider are legally irrelevant; or
• any particular penalty was proportionate - that assessment remained for the national court.

Lindqvist under the GDPR

Directive 95/46 has been replaced by the GDPR, but much of Lindqvist's logic remains visible in the current framework. The GDPR retains broad definitions of personal data and processing in Articles 4(1) and 4(2), protects data concerning health as a special category under Articles 4(15) and 9, and excludes processing by a natural person only when it occurs in the course of a purely personal or household activity under Article 2(2)(c). Recital 18 clarifies that the exemption relates to activities with no connection to professional or commercial activity and gives social networking and online activity as possible examples only when undertaken within the personal or household context.

• For an overview of the GDPR’s scope, definitions, principles, and requirements, see “EU Data Protection Law and the General Data Protection Regulation (GDPR).” (Free Subscription Required)

The transfer holding requires more caution. The GDPR's Chapter V governs transfers to third countries or international organizations, and modern online services often involve cloud infrastructure, recipients, processors, remote access, or disclosures that are materially different from Lindqvist's 1998 webpage. Lindqvist is best read for its precise conclusion that mere global accessibility was not automatically a transfer to every internet-connected country - not as a substitute for analyzing the actual actors, destinations, infrastructure, and disclosures in a contemporary processing operation.

Conclusion

Lindqvist transformed a small parish website into a foundational statement about the reach of EU data protection law. The Court treated names, hobbies, workplace details, and a brief injury reference as legally significant data; treated website publication as automated processing; and drew the household exemption around the private and family circle rather than around noncommercial intent.

At the same time, the judgment resisted absolutes. Global accessibility did not automatically become a transfer to every country, and data protection did not automatically defeat expression or religious participation. The practical lesson is therefore broader than 'a website is processing': once personal information leaves the genuinely private sphere, EU data protection law may apply, but its application must still account for context, competing rights, and proportionality.

Sources and Additional Resources

Sources

CJEU judgments, Advocate General opinions, procedural notices, summaries, and related materials are available through InfoCuria, the Court of Justice of the European Union's official case-law database.

Search Case C-101/01 on InfoCuria

• Court of Justice of the European Union, Case C-101/01, Criminal proceedings against Bodil Lindqvist, Judgment of 6 November 2003, ECLI:EU:C:2003:596.
• Advocate General Tizzano, Opinion in Case C-101/01, delivered 19 September 2002, ECLI:EU:C:2002:513. Read the Opinion.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, OJ 1995 L 281, p. 31. Read the Directive

Regulation (EU) 2016/679 (General Data Protection Regulation). Read the GDPR

Related reading from The de la Torre Review

• Breyer: When an IP Address Becomes Personal Data — Builds on Lindqvist’s interpretation of the scope of EU data-protection law. Breyer relies on Lindqvist in explaining the limits of the Directive’s exclusion for certain State activities, while also developing the Court’s influential test for determining when an individual is identifiable. Read the Article.
• ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing — Builds on Lindqvist’s understanding of Directive 95/46 as seeking an equivalent and high level of data protection throughout the EU. ASNEF applies that harmonization principle to the lawful bases for processing, holding that Member States may clarify EU rules but cannot add requirements that alter their scope. Read the Article.
• Satakunnan Markkinapörssi and Satamedia: Public Data Is Still Personal Data — Satakunnan relies on Lindqvist when interpreting the Directive’s scope and the exclusions in Article 3(2). It also develops the relationship between data protection and freedom of expression. Read the Article.
• “EU Data Protection Law and the General Data Protection Regulation (GDPR).” A broader guide to the framework that replaced Directive 95/46, including material scope, key definitions, special-category data, and international transfers. Read the Page (Free subscription required.)