Lindqvist v. Åklagarkammaren i Jönköping

Bodil Lindqvist (defendant) worked as a catechist at a church. Lindqvist used the Internet to set up pages on her personal computer to allow parishioners who were preparing for confirmation in the church to access information. The websites also contained information regarding Lindqvist and her colleagues. The information included people’s names, jobs, and hobbies, as well as their phone numbers and families. In one instance, Lindqvist published that one colleague had a foot injury. The web pages were stored on Swedish servers but were accessible in other countries. Before publishing this information, Lindqvist did not receive consent or even inform her coworkers of the web pages. When the coworkers eventually learned of the publication, some expressed disapproval, and Lindqvist removed the web pages. Swedish prosecutors (plaintiffs) charged Lindqvist with violating the Personuppgiftslagen (PUL), a domestic law that addressed personal-data protection consistent with Directive 95/46/EC (directive). Specifically, the prosecutors claimed that Lindqvist had violated the PUL by (1) processing personal data without giving notification to authorities, (2) processing sensitive personal data without authorization, and (3) processing personal data to a third country. The domestic trial court agreed and fined Lindqvist. Lindqvist appealed, and the intermediate appellate court referred the case to the European Union Court of Justice to determine whether the conduct was covered by the directive.