- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy, Satamedia Oy, – CJEU Judgment (Finland, 2008)
CJEU precedent (Directive 95/46/EC, pre-GDPR)
This is a Court of Justice judgment predating the GDPR. It interprets Directive 95/46/EC (the Data Protection Directive). It is not a cookie or ePrivacy case and is excluded from cookie statistics and the Risk Calculator.
The Court of Justice ruled that the collection and publication of tax data by a company must comply with data protection laws. This is significant because it clarifies how personal data can be processed for journalistic purposes. Companies should be careful about how they handle and share personal data, even if it is publicly available.
What happened
Satakunnan Markkinapörssi Oy published tax data of individuals without proper consent.
Who was affected
Approximately 1.2 million individuals whose tax information was published.
What the authority found
The Court decided that the processing of personal data for publication must still adhere to data protection principles.
Why this matters
This ruling reinforces the need for compliance with data protection laws, even when data is sourced from public records, reminding companies to handle personal information responsibly.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Reference for preliminary ruling was made by the Supreme Administrative Court in Helsinki (Korkein hallinto-oikeus). The reference related to the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Satakunnan Markkinapörssi Oy collected for its own use tax data on individuals available from the tax authorities. Using those data, it published each year in the regional editions of the Veropörssi newspaper containing a list giving tax information of approximately 1.2 million natural persons. Satakunnan Markkinapörssi Oy transferred the published personal data on a CD-ROM to Satamedia Oy (owned by the same shareholders) which disseminated them by a text messaging system.. Following complainta from individuals, the Finnish DPA investigated the activity of Satakunnan Markkinapörssi Oy and Satamedia Oy, and requested the data protection board (Tietosuojalautakunta) to prohibit the latter from carrying on the processing activities. The board rejected the request. Eventually, the DPA brought an appeal before the Supreme Administrative Court, which referred the following questions for a preliminary ruling: (1) Whether collection, publication, transfer of a CD ROM and text messages constitutes processing of personal data; (2) Whether it is processing for solely journalistic purposes within the meaning of Article 9 of Directive 95/46; (3) Whether Article 17 and principles of Directive 95/46 preclude publication of data collected for journalistic purposes and their onward transfer for commercial purposes; (4) Whether personal data that have already been published in the media fall outside scope of Directive 95/46. Definition of personal data Definition of processing Scope of Directive 95/46 Processing for solely journalistic purposes 1. Article 3(1) of Directive 95/46/EC is to be interpreted as meaning that an activity in which data on the earned and unearned income and the assets of natural persons are: – collected from documents in the public domain held by the tax authorities and processed for publication, – published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists, – transferred onward on CD-ROM to be used for commercial purposes, and – processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person, must be considered as the ‘processing of personal data’ within the meaning of that provision. 2. Article 9 of Directive 95/46 is to be interpreted as meaning that data relating to the earned and unearned income and assets of natural persons that are collected from documents in the public domain held by the tax authorities and a) processed for publication, and b) processed for the purposes of a text-messaging service, must be considered as activities involving the processing of personal data carried out ‘solely for journalistic purposes’, within the meaning of that provision, if the sole object of those activities is the disclosure to the public of information, opinions or ideas. Whether that is the case is a matter for the national court to determine. 3. Activities in which data relating to the earned and unearned income and assets of natural persons are a) transferred onward on CD-ROM to be used for commercial purposes, and b) processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person, relating to personal data files which contain solely, and in unaltered form, material that has already been published in the media, fall within the scope of application of Directive 95/46.
Outcome
CJEU Case
A judgment or Advocate General opinion in a case before the Court of Justice of the European Union.
Related Cases (0)
No other cases found for Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy, Satamedia Oy, in FI
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
16 December 2008
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-4084About this data
Cite as: Cookie Fines. Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy, Satamedia Oy, - Finland (2008). Retrieved from cookiefines.eu
Last updated: