Lindqvist (CJEU): Publishing personal data on internet is not a transfer to third

Transfers to third countries: The publication on the internet does not constitute a transfer, as an internet user would have to connect to the internet and personally carry out the necessary actions to consult those pages where: (i) the internet pages did not contain the technical means to send that information automatically to people who did not intentionally seek access; and, (ii) the internet page is stored with his/her hosting provider in that or another Member State. (¶¶ 60–61, 68, 70)

It appears from the court file that, in order to obtain the information appearing on the internet pages on which Mrs Lindqvist had included information about her colleagues, an internet user would not only have to connect to the internet but also personally carry out the necessary actions to consult those pages. In other words, Mrs Lindqvist's internet pages did not contain the technical means to send that information automatically to people who did not intentionally seek access to those pages.

It follows that, in circumstances such as those in the case in the main proceedings, personal data which appear on the computer of a person in a third country, coming from a person who has loaded them onto an internet site, were not directly transferred between those two people but through the computer infrastructure of the hosting provider where the page is stored.

Given, first, the state of development of the internet at the time Directive 95/46 was drawn up and, second, the absence, in Chapter IV, of criteria applicable to use of the internet, one cannot presume that the Community legislature intended the expression ‘transfer [of data] to a third country’ to cover the loading, by an individual in Mrs Lindqvist's position, of data onto an internet page, even if those data are thereby made accessible to persons in third countries with the technical means to access them.

Accordingly, it must be concluded that Article 25 of Directive 95/46 is to be interpreted as meaning that operations such as those carried out by Mrs Lindqvist do not as such constitute a 'transfer [of data] to a third country'. It is thus unnecessary to investigate whether an individual from a third country has accessed the internet page concerned or whether the server of that hosting service is physically in a third country.