Bodil Lindqvist – CJEU Judgment (Sweden, 2003)

The case is about Mrs. Lindqvist who worked as a catechist in the Alseda Parish (Sweden). At the end of 1998, she set up internet pages on her personal computer in order to allow parishioners preparing for their confirmation to obtain any information they needed. She requested the administrator of the Swedish Church’s website to set up a link between those pages and the website. The pages she had set up contained information about Mrs. Lindqvist and 18 of her colleagues in the parish. The pages contained information including their full names, first names, jobs held, hobbies, telephone numbers and medical information on one of her colleagues. She had not informed her colleagues of those pages, obtain their consent or sought approval from the supervisory authority to process the personal data and sensitive personal data. The public prosecutor brought a proceeding against her, that she was in breach of the PUL on grounds that she processed personal data automatically without giving prior written notice to the Supervisory Authority (Datainspektionen). In addition, she processed sensitive personal data and transferred personal data to a third country without authorization or consent from the data subjects. The Royal Court (Göta hovrätt) stayed the national proceedings and referred some question of law to the CJEU. The questions brought before the CJEU were: # Whether a self-made list, with personal data of others, published on the internet constitute processing of personal data wholly or partly by automatic means as defined under Article 3(1) Directive 95/46. # Whether the act of setting up internet home pages for 15 people with links between the pages which make it possible to search the pages using the first name be considered processing of personal data which forms part of a filing system within the meaning under Article 3(1) Directive 95/46? # Whether the processing of personal data is covered under the exception to processing under a household activity under Arti