TIETOSUOJAVALTUUTETTU [FINNISH DATA PROTECTION OMBUDSMAN] V. SATAKUNNAN MARKKINAPORSSI OY AND SATAMEDIA OY, 16.12.2008 (“SATAKUNNAN&SATAMEDIA”)

Processing: The collection, publication, transfer on a CD-ROM and by text messaging all constitute processing. This is the case even where the operations exclusively concern material that has already been published in unaltered form in the media. (¶¶ 35–37)

It must be held that the data to which this question relates, which comprise the surname and given name of certain natural persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned income, constitute personal data within the meaning of Article 2(a) of the directive, since they constitute ‘information relating to an identified or identifiable natural person’ (see also Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64).

It is sufficient to hold, next, that it is clear from the wording itself of the definition set out in Article 2(b) of the directive that the activity to which the question relates involves the ‘processing of personal data’ within the meaning of that provision.

Consequently, the answer to the first question must be that Article 3(1) of the directive is to be interpreted as meaning that an activity in which data on the earned and unearned income and the assets of natural persons are:

– collected from documents in the public domain held by the tax authorities and processed for publication,

– published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,

– transferred onward on CD-ROM to be used for commercial purposes, and

– processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person,

must be considered as the ‘processing of personal data’ within the meaning of that provision.