Järvenpää parish – Court Ruling (Finland, 2026)

A data subject brought a complaint to the DPA concerning the Järvenpää parish (the controller, a religious institution). The controller sent them a letter about their right to vote in the upcoming controller's elections. According to the data subject, the printed text in the envelope allowed third parties to infer that the data subject was a member of the Evangelical Lutheran Church. The DPA dismissed the complaint, and stated that the controller had not processed personal data expressing religious or political beliefs (Article 9 GDPR). In addition, the controller had a legal basis to process the data subject’s personal data through letters. This is because the controller had the duty to ensure that information related to the right to vote reaches the data subject. Finally, the DPA stated that the postal company distributing the envelopes had a duty of confidentiality. The data subject appealed the decision to the Administrative Court, who overturned the decision of the DPA. According to the court, the envelope allowed individuals to infer that the data subject was a member of the church. This indirect information on religious beliefs fell under the scope of Article 9(1) GDPR. Therefore, the controller violated Articles 5 and 9(2)(d) GDPR, as it was not necessary to include this data on the outside of the envelope. According to the court, the controller could have fulfilled the purpose of informing data subjects after the envelope was opened. The controller appealed the decision to the Supreme Administrative Court. The controller argued that including information on the elections on the outside of the envelope does not violate the GDPR, as religious communities have a strong freedom of religious communication. In addition, the controller argued that it implemented appropriate safeguards in processing the data subject’s data. On the other hand, the data subject argued that the controller did not comply with the requirements of data minimisation (Article 5(1)(c) GDPR) when processing data under Article 9(2) GDPR. The data subject argued that the controller could have delivered the information without including information about the controller. The court first clarified that personal data that indirectly reveals sensitive information relating to a data subject may fall under the scope of Article 9(1) GDPR, in accordance with CJEU case law.See C-184/20, Vyriausioji Tarnybinės jaikos Commissioner, margins 125 and 127 to 128 of the judgment, and Case C-21/23, Lindenapotheke, margins 81 to 82 This is also the case for information relating to the data subject to a certain probability but not an absolute certainty.See Case C-21/23, Lindenapotheke, margin 90 Applied to this case, the court noted that the information on church membership indirectly revealed by the outside of the envelope cannot itself be considered as specific evidence of a data subject’s religious beliefs. However, it may allow persons to draw inferences regarding a data subject’s religious beliefs. Therefore, the information on the envelope regarding the data subject’s membership of the church fell under the scope of Article 9(1) GDPR. The court then stated that the purpose of Article 9(1) GDPR is to ensure a better protection of special categories of personal data, as its processing may constitute a particularly serious interference with data subjects rights. When assessing processing of this data, it is also important to consider how seriously it can interfere with data subjects’ rights. The court made a distinction between the data in the outside of the envelope (that is not in itself a specific indication of a data subject’s beliefs) with views or behaviours that directly express religious beliefs; the court considered that the processing in this case did not constitute a serious interference with a data subject’s rights in comparison to data under Article 9(1) GDPR typically does. While Article 9(1) GDPR prohibits the processing of sensitive personal data, Article 9(2)(d) GDPR may be a valid legal basis when carried out in connection to legitimate activities of a religious community, and this data is not disclosed outside of the community without the data subject’s consent. In this case, the purpose of sending the letters was to inform data subjects of the elections. The court considered that this information was provided only to members of the church. Furthermore, the risk of third parties accessing it was low, especially considering the duty of confidentiality of the postal service. The fact that persons in the data subject’s household could access the envelope was not sufficient grounds to conclude that the information outside of the envelope should have been delivered inside the envelope, as the lower court had concluded. Therefore, the court considered that the controller had not violated the GDPR, as it processed the data with a valid legal basis and with appropriate safeguards. The court overturned the decision of the lower court and upheld the decision of the DPA.