> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Satakunnan & Satamedia: Public Data Is Still Personal Data
- URL: https://www.thedelatorrereview.com/satakunnan-satamedia-public-data-is-still-personal-data/
- Published: 2008-12-16T03:20:00.000Z
- Updated: 2026-09-13T02:11:51.000Z
- Description: Satakunnan & Satamedia held that public data remains personal data under EU law while interpreting the journalistic-purpose derogation broadly. The case shows how data protection must be reconciled with freedom of expression.
- Author: Lydia
- Tags: Court of Justice of the European Union (CJEU), Processing, Data Protection Directive, Directive 95/46/EC, Personal Information, Privacy Law, Data Protection Law, Balancing Test, Caselaw, General Data Protection Regulation (GDPR), Freedom of Expression/First Amendment

**Case C-73/07 | Court of Justice of the European Union | Grand Chamber | 16 December 2008**

> **Practice takeaways:** ① **Publicly available information can still be personal data.** ② Collecting, organizing, publishing, transferring, and redistributing public personal information are forms of **processing**. ③ Prior publication does not remove personal data from the scope of EU data-protection law. ④ “Journalistic purposes” must be interpreted broadly and are **not limited to traditional media or particular technologies**. ⑤ A profit motive does not, by itself, prevent processing from being journalistic. ⑥ But journalism is not a blanket exemption: derogations from data-protection rules apply only where **necessary to reconcile privacy and freedom of expression**. ⑦ The CJEU left the ultimate application of that balance to the Finnish courts.

*Satakunnan & Satamedia* asks a deceptively simple question: **does personal information stop being protected by EU data-protection law because the government has made it public?**

The CJEU’s answer was no.

The case involved Finnish tax information concerning approximately **1.2 million people**. The information was legally public, but companies collected it at scale, published it in searchable lists, transferred it on CD-ROM, and made individual tax records available through a paid text-message service. The Court held that these activities remained processing of personal data.

The harder question was whether the processing could benefit from the special derogations for **journalistic purposes**. There, the Court adopted a broad conception of journalism—but paired it with an important limitation: derogations from data-protection rules may extend only as far as necessary to reconcile privacy with freedom of expression.

## The dispute

Finnish law made certain tax information publicly available, including a taxpayer’s name and specified information concerning earned and unearned income and taxes. (Judgment, ¶¶ 20–23.)

For several years, Satakunnan Markkinapörssi Oy collected those public records and published extracts in regional editions of the *Veropörssi* newspaper. The publication included the names of approximately **1.2 million people** whose income exceeded specified thresholds, together with their earned and unearned income and wealth-tax information. The information was organized alphabetically by municipality and income bracket. Although the newspaper also contained articles, summaries, and advertisements, its main purpose was publishing personal tax information. (Judgment, ¶¶ 25–28.)

Markkinapörssi transferred the published data on CD-ROM to Satamedia Oy, which was owned by the same shareholders. Satamedia used the information for a text-message service: for approximately €2, a user could obtain tax information concerning a named individual. Individuals could request removal of their information from both the newspaper and the SMS service. (Judgment, ¶¶ 27, 29.)

Following complaints alleging violations of privacy, the Finnish Data Protection Ombudsman sought to prohibit the processing. After the Data Protection Board and Helsinki Administrative Court rejected the request, the dispute reached Finland’s Supreme Administrative Court, which referred the matter to the CJEU. (Judgment, ¶¶ 30–34.)

## Why This Case Matters

*Satakunnan & Satamedia* established an important principle that remains highly relevant under the GDPR: **personal data do not lose their protection merely because they are publicly available or have already been published.** The Court rejected an implied exemption for previously published information, reasoning that such an exception would largely deprive EU data-protection law of its effectiveness. (Judgment, ¶¶ 46–49.)

This is part of a broader feature of EU data-protection law: **“personal” does not mean “private.”** Information may qualify as personal data even when it is publicly available. For more on the breadth of the EU concept, see [**What Is ‘Personal Data’ Under EU Data Protection Law?**](https://www.thedelatorrereview.com/what-is-personal-data-under-eu-data-protection-law/) And for a comparison with California—where the CCPA/CPRA takes a different approach by expressly excluding certain publicly available information—see [**When Everything Is “Personal”: GDPR vs. CCPA**](https://www.thedelatorrereview.com/when-everything-is-personal-gdpr-vs-ccpa/)**.**

But the case is just as important for what it says about **journalism and freedom of expression**. The Court interpreted “journalistic purposes” broadly: the concept is not limited to traditional media organizations, does not depend on the technology used to communicate information, and is not automatically defeated because the activity is commercial. At the same time, derogations from data-protection requirements may apply only insofar as **strictly necessary to reconcile privacy with freedom of expression**. (Judgment, ¶¶ 52–61.)

## The Court’s Analysis

The Court began with the threshold questions under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46 or the Data Protection Directive.) The names of identified individuals together with information concerning their earned and unearned income constituted **personal data**. Collecting those records for publication, publishing them in alphabetical lists, transferring them on CD-ROM, and processing them through the SMS service were all forms of **processing**. (Judgment, ¶¶ 35–37.)

The fact that the underlying tax information was publicly available did not change that conclusion. Nor did the fact that some of the information had already been published. The Court rejected an implied exemption for previously published personal data, explaining that it would *“largely deprive the directive of its effect.”* Otherwise, Member States could publish personal data and thereby cause those data to lose the protection afforded by the Directive. (Judgment, ¶¶ 46–49.)

The more difficult question was whether the companies’ processing could benefit from the **derogations for journalistic purposes** under Article 9 of Directive 95/46\. The Court explained that the Directive sought to protect privacy while also respecting freedom of expression, and Article 9 was intended to reconcile those two fundamental rights. Because freedom of expression plays an essential role in a democratic society, concepts relating to it—including journalism—must be interpreted broadly. But because the Article 9 derogations restrict the protection of privacy, they may apply only **insofar as strictly necessary** to achieve that reconciliation. (Judgment, ¶¶ 52–56.)

---

> **Public availability does not create an exemption from data-protection law, but data-protection law must itself accommodate legitimate journalism and freedom of expression.**

---

The Court therefore adopted a broad conception of who may engage in journalism. 

- The derogation is available **not only to media undertakings but to every person engaged in journalism**. (Judgment, ¶ 58.)
- A **commercial purpose does not necessarily change the result**. The fact that public-domain information is published for profit does not, by itself, prevent the processing from being carried out solely for journalistic purposes. The Court recognized that commercial success may be necessary to sustain professional journalism. (Judgment, ¶ 59.)
- **Nor is the medium determinative.** Journalism is not confined to traditional newspapers, radio, or television; information may be communicated through other means, including electronic media. (Judgment, ¶ 60.)

The Court ultimately focused on the **object of the activity**. Activities may qualify as journalistic where their object is the disclosure to the public of **information, opinions, or ideas**, irrespective of the medium used. The processing at issue therefore could qualify as being carried out solely for journalistic purposes **if its sole object was the disclosure to the public of information, opinions, or ideas**. (Judgment, ¶¶ 61–62.)

Importantly, the CJEU **did not decide that Satakunnan and Satamedia’s mass publication of tax information or SMS service actually satisfied that test**. It established the governing interpretation of Article 9 and left the national court to determine whether the companies’ activities qualified. (Judgment, ¶ 62.)

## Advocate General Kokott: the public-interest question

Advocate General Juliane Kokott approached the journalistic-purpose question somewhat differently.

She agreed that journalism could not be defined simply by reference to the form of communication. Modern technologies such as the internet and mobile telecommunications can be used both to communicate matters of public interest and for purely private purposes. She therefore considered the **subject matter of the communication** important in determining whether journalistic purposes were being pursued. (Opinion, ¶ 72.)

For Kokott, information concerns a matter of public interest where **it relates to an existing public debate or concerns matters that are inherently of public interest.** By contrast, disclosure of details of an individual’s private life merely to satisfy curiosity may not contribute to a debate of general interest. (Opinion, ¶¶ 73–77.)

That distinction made the individualized SMS service particularly interesting. The service allowed a user to enter a person’s name and municipality and receive that individual’s earned income, unearned income, and wealth information. (Opinion, ¶ 20.)

The Opinion therefore provides a useful counterpoint to the Judgment. The Court ultimately adopted a broader formulation centered on whether the sole object of the activity was disclosure of information, opinions, or ideas; it did not incorporate Kokott’s proposed public-interest inquiry into the operative test. (Judgment, ¶¶ 61–62; Opinion, ¶¶ 72–77.)

## What the Court did—and did not—decide

The Court **did decide** that:

- names linked to income information constituted personal data
- collecting, publishing, transferring, and distributing those data constituted processing**;**
- previously published information remained within Directive 95/46;
- journalism must be interpreted broadly, while derogations must remain strictly necessary;
- the journalistic derogation is not limited to traditional media organizations;
- profit-making does not automatically defeat the derogation; and
- the medium used is not determinative (Judgment, ¶¶ 60–61).

But the Court **did not decide whether the companies’ particular processing ultimately qualified for the journalistic-purpose derogation**. That determination was expressly left to the national court. (Judgment, ¶ 62.)

## What happened next

The preliminary ruling did not end the dispute. The Finnish Supreme Administrative Court subsequently applied the CJEU’s interpretation and concluded that the processing could not benefit from the journalistic derogation to the extent claimed. It sent the matter back to the Data Protection Board, ultimately leading to restrictions on the publication and SMS service.

The companies later took the dispute to the **European Court of Human Rights**. In 2017, the ECtHR Grand Chamber found **no violation of Article 10 ECHR** arising from the restrictions imposed on the companies’ publication of the tax information. Of particular importance, the ECtHR distinguished between a public interest in **access to tax information** and a public interest in disseminating enormous quantities of raw tax data *en masse* without analytical input.

That subsequent history adds an important dimension to the CJEU judgment: **a broad conception of journalism does not mean that every mass dissemination of public personal data is protected from data-protection restrictions.**

## Satakunnan under the GDPR

Directive 95/46 has since been replaced by the **General Data Protection Regulation (GDPR)**, but the central tension identified in *Satakunnan* remains. Article 85 GDPR continues to require Member States to reconcile the right to protection of personal data with freedom of expression and information, including processing for journalistic purposes.

And the CJEU’s core reasoning remains highly relevant. Public availability does not itself remove personal information from the scope of data-protection law, and the protection of personal data must be reconciled with freedom of expression rather than automatically displacing it. (Judgment, ¶¶ 46–49, 52–56.)

If anything, the underlying issue has become more important. Digital technologies can transform information that is technically public but practically dispersed into searchable, aggregated, and instantly retrievable profiles. *Satakunnan* reminds us that **the public character of the source does not end the data-protection analysis.**

## Conclusion

*Satakunnan & Satamedia* rejects a proposition that can still sound intuitive today: **“the information was already public, so data-protection law does not apply.”**

Public availability does not erase the personal character of information, and collecting, organizing, publishing, transferring, and redistributing public information can constitute processing subject to data-protection law.

But the judgment is equally important for freedom of expression. Journalism is interpreted broadly: it is not confined to traditional media organizations, a particular technology, or noncommercial activity. At the same time, derogations from data-protection requirements may go no further than strictly necessary to reconcile privacy with freedom of expression.

**The enduring lesson: public data is still personal data, and journalism can justify special treatment—but neither “public” nor “journalistic” is a blank check under EU data-protection law.**

## Sources

CJEU judgments, Advocate General opinions, procedural notices, summaries, and related case materials are available through [**InfoCuria**](https://infocuria.curia.europa.eu/tabs/tout?lang=EN&ref=thedelatorrereview.com), the Court of Justice of the European Union’s official case-law database.

- Court of Justice of the European Union, Grand Chamber, Case C-73/07, *Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy*, Judgment of 16 December 2008, ECLI:EU:C:2008:727.
- Opinion of Advocate General Juliane Kokott in Case C-73/07, *Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy*, delivered 8 May 2008.

### Related De La Torre Review Resources

- **Lindqvist: When a Parish Website Became Data Processing** — On the breadth of “personal data” and “processing” under EU data-protection law. [Read the Article.](https://www.thedelatorrereview.com/lindqvist-when-a-parish-website-became-data-processing/)
- **Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy** — On the tension between disclosure of individuals’ financial information and privacy. [Read the Article.](https://www.thedelatorrereview.com/rundfunk-when-salary-transparency-meets-the-right-to-privacy/)
- **Schecke: Transparency Does Not Automatically Trump Data Protection** — Relying on *Satakunnan & Satamedia*, the Court reiterated that limitations on personal-data protection must be strictly necessary and held that transparency did not justify indiscriminate publication of agricultural-aid recipients’ names and exact payments. [Read the Article](https://www.thedelatorrereview.com/schecke-transparency-does-not-automatically-trump-data-protection/)
- **Bavarian Lager: When Transparency Requests Become Data-Protection Questions** —*Bavarian Lager* reinforces the same basic distinction from another angle: information does not cease to be personal data merely because it appears in a document subject to transparency rules. The names of individuals participating professionally in a Commission meeting remained personal data, and their disclosure remained subject to EU data-protection requirements.[Read the Article.](https://www.thedelatorrereview.com/bavarian-lager-when-transparency-requests-become-data-protection-questions/)
- **Breyer: When an IP Address Becomes Personal Data** — Builds on *Satakunnan & Satamedia* in defining the scope of EU data-protection law. *Breyer* relies on that earlier judgment when considering the Directive’s exclusions for certain State activities and separately develops the Court’s approach to determining when a person is **identifiable**. [Read the Article.](https://www.thedelatorrereview.com/breyer-when-an-ip-address-becomes-personal-data/)
- **What Is ‘Personal Data’ Under EU Data Protection Law?**— A detailed guide to the EU definition of personal data, including why the concept extends to information regardless of whether it is public or private. [Read the Article.](https://www.thedelatorrereview.com/what-is-personal-data-under-eu-data-protection-law/)
- **When Everything Is “Personal”: GDPR vs. CCPA** — A comparison of the GDPR and CCPA/CPRA definitions of personal information, including their different treatment of publicly available information. [Read the Article.](https://www.thedelatorrereview.com/when-everything-is-personal-gdpr-vs-ccpa/)

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/09/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-12.png)