Mentioning someone by name on a web site
posted by Jonathan Zittrain
Colleague Karen McCullagh has pointed out a decision from the European Court of Justice that appears to suggest that the inclusion of identifiable personal data on a personal web page could run afoul of the European data directive.
From her description, drawing from the Court’s facts of the case:
Mrs Lindqvist set up internet pages at home on her personal computer in
order to allow parishioners preparing for their confirmation to obtain
information they might need. At her request, the administrator of the
Swedish Church’s website set up a link between those pages and that site.
The pages in question contained information about Mrs Lindqvist and 18
colleagues in the parish, sometimes including their full names and in
other cases only their first names. Mrs Lindqvist also described, in a
mildly humorous manner, the jobs held by her colleagues and their hobbies.
In many cases family circumstances and telephone numbers and other matters
were mentioned. She also stated that one colleague had injured her foot
and was on half-time on medical grounds.
Mrs Lindqvist had not informed her colleagues of the existence of those
pages or obtained their consent, nor did she notify the supervisory
authority for the protection of electronically transmitted data of her
activity. She removed the pages in question as soon as she became aware
that they were not appreciated by some of her colleagues.
The European Court of Justice Held:
1) The act of referring, on an internet page, to various persons and
identifying them by name or by other means, for instance by giving their
telephone number or information regarding their working conditions and
hobbies, constitutes the processing of personal data wholly or partly by
automatic means within the meaning of Article 3(1) of Directive 95/46.
2) reference to the fact that an individual has injured her foot and is on
half-time on medical grounds constitutes personal data concerning health
within the meaning of Article 8(1) of Directive 95/46.
The full opinion can be found here. This result does seem pretty extreme, and I’m trying to figure out what limiting principle there is — other than it being largely disregarded and practically difficult to enforce — by which people who mention other people in a blog post (and the fact that they might be feeling under the weather) are not running afoul of privacy regulations.
July 19, 2007 at 5:28 pm
Posted in: Privacy
Print This Post
Responses (1)
mmm - July 19, 2007 at 6:40 pm
Err… that’s a horrible decision. Has it been cited as precedent? On the one hand, I can understand the temptation to read the directive this way: an otherwise non-public person’s private details being made relatively accessible. But on the other, this would seem to encompass too much behavior the privacy directive was not aimed at curtailing. But, then again, it is drafted SO broadly.
Also, the result was really just a slap on the wrist ~$600, why would anyone want to pursue that claim that far?
Leave a Reply