The GDPR applies to the processing of personal data wholly or partly by
automated means and to the processing other than by automated means of personal
data which form part of a filing system or are intended to form part of a filing system
[art. 2(1)].
3 The GDPR does not apply to personal data of deceased persons are not
governed by the GDPR. Moreover, the GDPR does not cover the processing of
personal data which concerns legal persons, such as undertakings established as
legal persons. However, the fact that information concerning natural persons is
provided as part of a professional activity does not mean that it cannot be
characterised as personal data.
4
The GDPR does not apply to the processing of personal data by a natural person
in the course of a purely personal or household activity [art. (2)(2)(c)]. This exception covers only activities that are carried out in the context of the private or family
life of individuals. The CJEU has held that such an exception does not relate to the
processing of personal data consisting in publication on the internet so that those
data are made accessible to an indefinite number of people.
5 Moreover, the CJEU has
ruled that door-to-door preaching by members of a religious community is not a
purely personal or household activity because the preaching extends beyond the
private sphere of a member of a religious community who is a preacher.
6
The GDPR does not apply to the processing of personal data in the course of
activities which fall outside the scope of Union law, such as activities concerning
national security, or to the processing of personal data by competent authorities for the
purposes of the prevention or prosecution of criminal offences (see this chapter, Sect.
3.4, infra). The GDPR does not apply to matters concerning the processing of personal
data in connection with the provision of publicly available electronic communications
services in public communication networks in the Union in relation to matters for which
they are subject to specific obligations (see this chapter, Sect. 3, infra). Moreover, the
processing of personal data by the Union institutions is governed by Regulation
(EC) No 45/2001 of the European Parliament and of the Council of 18 December
2000.
7 This Regulation contains measures with regard to the processing of personal
data by the Union institutions and the free movement of such data. It is based on the
same principles that the general framework on data protection in EU law.
The Court of Justice of the European Union (CJEU) has developed a significant
body of case law regarding the interpretation of the EU instruments in the field of
3 The free movement of personal data within the EU granted by GDPR is intended to be
complemented by a new Regulation on a framework for the free flow of non-personal, see the
Proposal of 13 September 2017 by the Commission at COM(2017) 495 final.
4 See Judgments of the CJEU of 16 July 2015, ClientEarth and PAN Europe v. EFSA, C-615/13 P,
EU:C:2015:489, para. 30; and of 9 March 2017, C-398/15, Camera di Commercio, Industria,
Artigianato e Agricoltura di Lecce v. Salvatore Manni, ECLI:EU:C:2017:197, para. 34.
5 Judgment of the CJEU of 6 November 2003, Bodil Lindqvist, C-101/01, ECLI:EU:C:2003:596,
para. 47.
6 Judgment of the CJEU of 10 July 2018, Jehovan todistajat, C-25/17, ECLI:EU:C:2018:551, para.
50.
7 OJ L 8, 12.1.2001, p. 1.
458
P. A. de Miguel Asensio
automated means and to the processing other than by automated means of personal
data which form part of a filing system or are intended to form part of a filing system
[art. 2(1)].
3 The GDPR does not apply to personal data of deceased persons are not
governed by the GDPR. Moreover, the GDPR does not cover the processing of
personal data which concerns legal persons, such as undertakings established as
legal persons. However, the fact that information concerning natural persons is
provided as part of a professional activity does not mean that it cannot be
characterised as personal data.
4
The GDPR does not apply to the processing of personal data by a natural person
in the course of a purely personal or household activity [art. (2)(2)(c)]. This exception covers only activities that are carried out in the context of the private or family
life of individuals. The CJEU has held that such an exception does not relate to the
processing of personal data consisting in publication on the internet so that those
data are made accessible to an indefinite number of people.
5 Moreover, the CJEU has
ruled that door-to-door preaching by members of a religious community is not a
purely personal or household activity because the preaching extends beyond the
private sphere of a member of a religious community who is a preacher.
6
The GDPR does not apply to the processing of personal data in the course of
activities which fall outside the scope of Union law, such as activities concerning
national security, or to the processing of personal data by competent authorities for the
purposes of the prevention or prosecution of criminal offences (see this chapter, Sect.
3.4, infra). The GDPR does not apply to matters concerning the processing of personal
data in connection with the provision of publicly available electronic communications
services in public communication networks in the Union in relation to matters for which
they are subject to specific obligations (see this chapter, Sect. 3, infra). Moreover, the
processing of personal data by the Union institutions is governed by Regulation
(EC) No 45/2001 of the European Parliament and of the Council of 18 December
2000.
7 This Regulation contains measures with regard to the processing of personal
data by the Union institutions and the free movement of such data. It is based on the
same principles that the general framework on data protection in EU law.
The Court of Justice of the European Union (CJEU) has developed a significant
body of case law regarding the interpretation of the EU instruments in the field of
3 The free movement of personal data within the EU granted by GDPR is intended to be
complemented by a new Regulation on a framework for the free flow of non-personal, see the
Proposal of 13 September 2017 by the Commission at COM(2017) 495 final.
4 See Judgments of the CJEU of 16 July 2015, ClientEarth and PAN Europe v. EFSA, C-615/13 P,
EU:C:2015:489, para. 30; and of 9 March 2017, C-398/15, Camera di Commercio, Industria,
Artigianato e Agricoltura di Lecce v. Salvatore Manni, ECLI:EU:C:2017:197, para. 34.
5 Judgment of the CJEU of 6 November 2003, Bodil Lindqvist, C-101/01, ECLI:EU:C:2003:596,
para. 47.
6 Judgment of the CJEU of 10 July 2018, Jehovan todistajat, C-25/17, ECLI:EU:C:2018:551, para.
50.
7 OJ L 8, 12.1.2001, p. 1.
458
P. A. de Miguel Asensio