# TIETOSUOJAVALTUUTETTU [FINNISH DATA PROTECTION OMBUDSMAN] V. SATAKUNNAN MARKKINAPORSSI OY AND SATAMEDIA OY, 16.12.2008 (“SATAKUNNAN&SATAMEDIA”)

- Type: Case Law
- Source: CJEU
- Date: 2008-12-16
- Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62006CJ0073&ref=6186
- Canonical: https://overview.legal/posts/6186
- Topics: Personal Data, Processing, Lawful Basis, Right to Restriction, Statistics, IP Address, Public Authority, Identification, International Transfer, Human Resources

## Summary

Processing: The collection, publication, transfer on a CD-ROM and by text messaging all constitute processing. This is the case even where the operations exclusively concern material that has already been published in unaltered form in the media. (¶¶ 35–37)

## Sections (2)

### ¶36

It is sufficient to hold, next, that it is clear from the wording itself of the definition set out in Article 2(b) of the directive that the activity to which the question relates involves the ‘processing of personal data’ within the meaning of that provision.

> Topics: Personal Data, Processing · Applies: gdpr-art-2-en

### ¶37

Consequently, the answer to the first question must be that Article 3(1) of the directive is to be interpreted as meaning that an activity in which data on the earned and unearned income and the assets of natural persons are: – collected from documents in the public domain held by the tax authorities and processed for publication, – published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists, – transferred onward on CD-ROM to be used for commercial purposes, and – processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person, must be considered as the ‘processing of personal data’ within the meaning of that provision.

> Topics: Public Authority, Personal Data, Processing · Applies: gdpr-art-3-par-1-en

## Cited law provisions (2)

### GDPR — gdpr-art-3-par-1-en

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

### GDPR — gdpr-art-2-en

Material scope

---
Generated by overview.legal · https://overview.legal/posts/6186 · 2026-08-22