ECJ Rules Web Site Posting Does not Amount to a Transfer of Data to Non-EU Countries

The European Court of Justice (ECJ) has ruled that the placement of personal information on a web site does not constitute the transfer of data outside the European Union (EU). The case involved criminal charges brought under Swedish data protection laws against a Swedish woman who placed the personal details of her fellow parish members on a church web site without their consent.   At trial, the Swedish district court imposed a fine.   The defendant appealed.   Before deciding the appeal, the Göta hovrätt (Göta Court of Appeal) sought a preliminary ruling from the ECJ on several questions regarding the interpretation of EU Directive 95/46/EC (Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data). In its preliminary rulings, the ECJ made two key findings.   First, the ECJ held that placing personal data on a web site constitutes the processing of data within the meaning of the legislation and is not covered by any of the exceptions in the Directive.   Second, there is no transfer of data to a third country within the meaning of Article 25 of the Directive where an individual within a EU Member State loads data onto a web site hosted by an Internet Service Provider established within a EU Member State.   In the opinion of the ECJ, if the placement of data under Article 25 were interpreted to mean that there was a data transfer to a third country every time personal data was placed on a web site, then EU Member States would be forced to prevent any personal data from appearing on a web site given that not all countries provide an "adequate" level of protection. For a copy of the decision, see: http://makeashorterlink.com/?C2C2647B6. For a copy of the EU Directive 95/46/EC, see: http://europa.eu.int/comm/internal_market/privacy/law_en.htm. Summary by: Colin Adams