Key References:

  • GDPR Art. 4(2) on definition of processing
  • GDPR Art. 2(2)(c) on exceptions to processing
  • GDPR Art. 27(2)(a) on occasional processing
  • Recitals 15, 18, 19
  • CJEU’s Lindqvist case (C-101/01) on Personal Household Exception
  • EDPB Guidelines 3/2019 on processing of personal data through video devices

Art. 4(2) Key elements:

  • any operation performed on personal data
  • whether manually or by automated means
  • such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

GDPR defines “processing” in a very expansive manner that virtually involves any interaction with personal data.

Processing Excluded from GDPR Application:

Art. 2(2): The Regulation does not apply to the processing of personal data

  • (c) by a natural person in the course of a purely personal or household activity;.

Recital 15 states that files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of the Regulation.

CJEU Lindqvist case (C-101/01) (2003) on Household Exception:

  • Facts:
    • Mrs. Lindqvist was charged with violating the Data Protection Directive, as implemented in the Swedish national legislation, for publishing personal data without consent on her personal website. Lindqvist worked and also volunteered in her local Church parish.
    • Lindqvist had a personal website where she posted information on Church related matters including information on several Church employees and volunteers such as their names, telephone numbers, job titles, hobbies, and in one case the health status of a member. The information was posted without the knowledge or consent of her coworkers. However, Lindqvist pulled down the webpages as soon as her colleagues learned of its existence and found it objectionable.
    • Lindqvist was charged with a criminal offense for publishing sensitive personal data without consent and violating the data protection laws. Furthermore, Lindqvist was ordered to pay damages to the victims. Lindqvist appealed her sentence to CJEU.
  • Issues: The issues at dispute were:
    • a) Does publishing personal information on a webpage constitute processing of personal data wholly or partly by automatic means?
    • b) Lindqvist published personal data of third parties on her personal website. Does that constitute personal household exception?
    • c) The personal information posted on the webpage could be hosted, stored, or accessible from anywhere in the world. Does that constitute transfer of personal data to third countries?
  • Holding:
    • a) The CJEU held that the definition of “processing” included “disclosure by transmission, dissemination or otherwise making data available“. The CJEU also held that since internet operations are performed automatically at least in part, publishing personal information on a webpage constitute processing of personal data wholly or partly by automatic means within the meaning of the Directive.
    • b) Lindqvist argued that she published data on her personal webpage in the course of charitable or religious activities without any commercial interests. She was exercising her freedom of expression and therefore subject to the personal household exception under the Directive.
    • The CJEU stated that the personal household exception must, “be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people“. In other words, the CJEU held that even non-profit, charitable, religious activities are subject to the Data Protection Directive.
    • c) The CJEU noted that the Directive does not define the expression ‘transfer to a third country’. Furthermore, the CJEU separated the activities of Lindqvist from the activities carried out by her webpage’s hosting providers. The CJEU held that the term ‘transfer to a third countries’ does not constitute the act of loading information on a webpage by an individual even if the technical means exist for data to be accessible in third countries. Therefore, the CJEU held that Lindqvist did not transfer data to third countries.
    • Finally, the CJEU held that the Directive made it possible for EU member state to maneuver in national legislation so as to balance freedom of expression and data protection rights of data subjects.

EDPB Guidelines 3/2019 on processing of personal data through video devices

  • The EDPB guidelines on video devices analyze GDPR Art (2)(2)(c) and Recital 18 on personal household exception as it applies to video recordings and held that, “[t]his provision – the so-called household exemption – in the context of video surveillance must be narrowly construed.” (Para. 12).
  • Guidelines para. 13 enunciates factors to take into account in order to determine household exceptions, including whether, “the user of video surveillance at home … has some kind of personal relationship with the data subject, whether the scale or frequency of the surveillance suggests some kind of professional activity on his side, and of the surveillance’s potential adverse impact on the data subjects.”