# TIETOSUOJAVALTUUTETTU [FINNISH DATA PROTECTION OMBUDSMAN] V. SATAKUNNAN MARKKINAPORSSI OY AND SATAMEDIA OY, 16.12.2008 (“SATAKUNNAN&SATAMEDIA”)

- Type: Case Law
- Source: CJEU
- Date: 2008-12-16
- Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62006CJ0073&ref=6185
- Canonical: https://overview.legal/posts/6185
- Topics: Personal Data, Processing, Public Authority, Human Resources, Identification, Public Sector, Transparency

## Summary

Personal data: Surname, given name of certain natural persons whose income exceeds certain thresholds as well as the amount of their earned and unearned income constitute personal data. The fact the the information was made publicly available by a governmental agency and that is had already been published in unaltered form in the media does not exempt it from the scope of data protection law.

## Sections (5)

### ¶35

It must be held that the data to which this question relates, which comprise the surname and given name of certain natural persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned income, constitute personal data within the meaning of Article 2(a) of the directive, since they constitute ‘information relating to an identified or identifiable natural person’ (see also Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64).

> Topics: Identification, Personal Data · Applies: gdpr-art-2-en

### ¶46

Moreover, it should be pointed out that the directive does not lay down any further limitation of its scope of application.

### ¶47

In that regard, the Advocate General observes at point 125 of her Opinion that Article 13 of the directive permits derogations from its provisions only in certain cases, which do not extend to the provisions of Article 3.

> Applies: gdpr-art-3-en, gdpr-art-13-en

### ¶48

Lastly, it must be held that a general derogation from the application of the directive in respect of published information would largely deprive the directive of its effect. It would be sufficient for the Member States to publish data in order for those data to cease to enjoy the protection afforded by the directive.

### ¶49

The answer to the fourth question should therefore be that activities involving the processing of personal data such as those referred to at points (c) and (d) of the first question and relating to personal data files which contain solely, and in unaltered form, material that has already been published in the media, fall within the scope of application of the directive.

> Topics: Personal Data, Processing

## Cited law provisions (3)

### GDPR — gdpr-art-2-en

Material scope

### GDPR — gdpr-art-3-en

Territorial scope

### GDPR — gdpr-art-13-en

Information to be provided where personal data are collected from the data subject

---
Generated by overview.legal · https://overview.legal/posts/6185 · 2026-08-22