Criminal Proceedings Against Bodil Lindqvist

1. Case Citation and Basic Information

Case Name: Criminal Proceedings against Bodil Lindqvist

Citation: Case C-101/01, ECLI:EU:C:2003:596 [2003] ECR I-12971

Court: Court of Justice of the European Communities (CJEU)

Date of Decision: 6 November 2003

Referring Court: Göta hovrätt (Göta Court of Appeal), Sweden

Bench: Full Court — President V. Skouris with eight judges; Advocate General A. Tizzano

Key Legislation: Directive 95/46/EC on the protection of personal data (the ‘Data Protection Directive’)

2. Introduction

In 2003, the Court of Justice of the European Communities delivered its first ruling on how data protection law applies to the internet, and it did so through the story of a Swedish church volunteer.[1] Bodil Lindqvist v Åklagarkammaren i Jönköping is the foundational case of EU digital privacy law. It established that uploading personal information about others onto a webpage constitutes ‘processing of personal data’, that health information attracts the highest level of protection regardless of how trivial it may seem, and that passive internet hosting does not amount to a cross-border data transfer. These holdings were absorbed into the General Data Protection Regulation (GDPR) and continue to shape data protection law to this day.[2]

3. Facts of the Case

Bodil Lindqvist was a catechist volunteer at a parish church in Alseda, Sweden. In late 1998, she built a small set of web pages on her home computer to help young parishioners prepare for their confirmation. She wanted to make it easy for them to find out who their church workers were, so she uploaded information about herself and around 18 of her colleagues: their names, job roles, hobbies, family details, and telephone numbers.[3]

One entry stood out. Next to a colleague’s name, Mrs Lindqvist noted that she had injured her foot and was working on a half-time basis for medical reasons. That single line of text would become the centrepiece of a criminal prosecution. Since Mrs Lindqvist had not asked for consent, her colleagues were not aware that these pages were being created. And she had not notified Sweden’s data protection authority, the Datainspektionen, as required under Swedish law. When colleagues discovered the pages and complained, she took them down immediately.

Despite the prompt removal, the Swedish public prosecutor charged her on three counts: processing personal data without notifying the supervisory authority; processing sensitive health data without authorisation; and unlawfully transferring personal data to third countries, on the basis that her pages were accessible to anyone in the world with an internet connection.

The trial court found her guilty and fined her. She appealed to the Göta hovrätt (Court of Appeal), which recognised that the case raised novel questions about how EU data protection law applied to the internet. It referred six questions to the CJEU for a preliminary ruling.

4. Legal Issues

The CJEU was asked to determine the following questions:

Issue 1: Whether uploading personal data about named individuals onto a webpage constitutes ‘processing of personal data by automatic means’ under Article 3(1) of Directive 95/46/EC?

Issue 2: Whether such activity falls within the ‘purely personal or domestic activity’ exception under Article 3(2), exempting it from the Directive entirely?

Issue 3: Whether a voluntary religious activity escapes the Directive’s scope as a matter falling outside ‘Community activities’?

Issue 4: Whether a passing reference to a colleague’s foot injury constitutes processing of sensitive data ‘concerning health’ under Article 8(1), regardless of how minor the disclosure was?

Issue 5: Whether making personal data accessible via an EU-hosted website that is accessible globally constitutes a ‘transfer to a third country’ under Article 25 of the Directive?

Issue 6: Whether Member States are permitted to enact data protection laws that go further than the Directive requires?

5. Arguments Presented

5.1 Mrs Lindqvist’s Arguments

Mrs Lindqvist argued that what she did was not the kind of activity that data protection law was designed to regulate. She was not a business, a government, or a professional data handler. She was a church volunteer trying to help teenagers. Her first argument was that publishing names and job descriptions on a personal webpage was ordinary communication, not systematic data ‘processing’. Second, she argued that her activity was purely personal and therefore fell within the household exemption. Third, she contended that uploading data to a Swedish server could not constitute a transfer abroad as she was not sending data anywhere; if someone in another country chose to access her pages, that was their own decision. Finally, she argued that prosecuting a volunteer for a minor and quickly corrected disclosure was disproportionate and inconsistent with the right to freedom of expression.

5.2 The Prosecution’s Arguments

The prosecution took the opposite view at every turn. It argued that the Directive’s definitions were deliberately broad and that uploading personal data to a webpage clearly constituted automatic processing. The household exemption, it argued, was intended for things like a personal address book or private letters, and not for pages published on the public internet. On health data, the prosecution maintained that any reference to a medical condition, however brief, triggered Article 8(1)’s protections. And on third-country transfers, it argued that the global accessibility of internet pages did mean the data had been transferred beyond the EU’s borders

6. Court’s Reasoning and Analysis

The Court approached each issue methodically, and its analysis was expansive throughout, except on one crucial point.

On the question of processing (Issues 1–3), the Court gave the Directive’s definitions their fullest possible reach. It held that loading personal data onto a webpage is unambiguously processing by automatic means.[4] The charitable or religious nature of the activity made no difference. The Directive’s first-indent exception, which covers matters of national security and state criminal law, was simply not applicable here. The household exemption was interpreted narrowly: it protects genuinely private activities such as writing in a personal diary or keeping a family address book, not the publication of information about 18 named colleagues on a publicly accessible website.

On health data (Issue 4), the Court’s reasoning was equally firm. Article 8(1) protects data ‘concerning health’, and that phrase must be read broadly. A colleague’s foot injury and reduced working hours for medical reasons fall squarely within that definition.⁴ The Court refused to introduce any proportionality threshold: it does not matter how minor or incidental the health disclosure is. The nature of the data triggers the protection.

On third-country transfers (Issue 5), the Court reached its most surprising and consequential conclusion. It held that passively hosting personal data on an EU server does not constitute a transfer to a third country merely because someone abroad can technically access it.⁵ The Court reasoned that Article 25’s cross-border transfer regime was designed for intentional transmissions of data across borders. To extend it to all internet hosting would effectively subject every website in Europe to the special third country transfer rules, a result the legislature could not have intended and that would paralyse the internet’s ordinary functioning.

On Member State discretion (Issue 6), the Court affirmed that national legislatures may go further than the Directive requires, provided they stay within its framework. This is a holding whose significance only became fully visible later; it is the legal basis on which France, in 2016, would enact laws protecting the personal data of deceased persons, something the Directive itself had never contemplated

7. Judgment and Ratio Decidendi

The Court upheld the prosecution on the main counts. Mrs Lindqvist had processed personal data without prior notification to the supervisory authority, and had processed sensitive health data without authorisation.6 She was not found to have made an unlawful third-country transfer.

The ratio decidendi may be stated as follows: the act of uploading personal data about named individuals onto a publicly accessible website constitutes processing of personal data by automatic means within the meaning of Directive 95/46/EC, regardless of whether the activity is commercial or charitable; health data attracts heightened protection without any proportionality threshold; and passive hosting of data on an EU server does not constitute a transfer to a third country within Article 25, even if the data is globally accessible.

8. Critical Analysis

8.1 Significance of the Decision

Lindqvist is where EU data protection law and the internet first met in a courtroom. Every definition the GDPR now uses for ‘processing’ and ‘personal data’ flows directly from what the Court established here.⁷ The case was cited by the Court in Google Spain⁸ and remains a live authority in EU digital privacy law. For a judgment arising from a parish website, its reach is extraordinary.

8.2 Implications and Impact

The most immediate practical impact was to confirm that data protection law applies to everyone, not just corporations or governments, but also to any individual who publishes information about others online.⁹ This democratisation of compliance obligations was transformative. It also created a puzzle that persists to this day: the IAPP has called it the “Lindqvist Loophole”.¹⁰ If passive hosting is not a third-country transfer, how does one reconcile that with Google Spain, where a California-based company was held subject to EU law for indexing European web content? The CJEU has not yet directly resolved the tension.

8.3  Critical Evaluation

The judgment’s reasoning is doctrinally rigorous, but it rests on an assumption that has quietly aged badly: that the data subject is always alive. The entire architecture of the Directive and of Lindqvist is built around a living natural person who can object, consent, and enforce rights. The GDPR made this explicit: Recital 27 states that it does not apply to deceased persons.¹¹ Yet the Court in Lindqvist also confirmed that Member States may go further.¹² France acted on that permission in 2016, introducing ‘digital wills’ that allow people to instruct how their data should be handled after death. India’s DPDP Act 2023 did not. India has recognised privacy as a fundamental right, yet leaves digital remains entirely unprotected. The gap that Lindqvist’s own logic would have permitted closing remains open.

9. Conclusion

Bodil Lindqvist was a church volunteer who wanted to help teenagers find their confirmation teachers online. What she inadvertently did was hand European data protection law its first internet test case. The Court’s answers that online publication is processing, that health data needs no minimum threshold of seriousness to deserve protection, and that passive hosting is not a cross-border transfer have proved durable across two decades and a full legislative overhaul.

The single most important thing to understand from Lindqvist is that EU data protection law is not reserved for the powerful. It reaches everyone who processes personal data about others, however informally and however well-intentioned. That breadth is its greatest strength.

What the case could not anticipate is the question it leaves unanswered: if the law is precise enough to reach a parish website, what is it waiting for when the dead speak words they never said? That remains the most pressing unresolved question in the legacy of this quietly revolutionary case.

Reference(S):

Cases

1. Criminal Proceedings against Bodil Lindqvist, Case C-101/01, 2003 E.C.R. I-12971 (Nov. 6, 2003).
2. Google Spain SL v. Agencia Española de Protección de Datos (AEPD), Case C-131/12, 2014 E.C.R. I-317 (May 13, 2014).
3. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India).

Legislation

1. Council Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) 31.
2. Commission Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data (General Data Protection Regulation), 2016 O.J. (L 119) 1.
3. Loi 2016-1321 du 7 octobre 2016 pour une République Numérique [Law 2016-1321 of October 7, 2016 for a Digital Republic], JOURNAL OFFICIEL DE LA RÉPUBLIQUE FRANÇAISE [J.O.], Oct. 8, 2016.
4. Digital Personal Data Protection Act, No. 22 of 2023 (India).

Secondary Sources

1. European Data Protection Supervisor, Case Law Digest: Transfers of Personal Data to Third Countries ¶ 69 (June 2021), https://www.edps.europa.eu/system/files/2021-06/21-06-09_case-law-digest_en.pdf.
2. Bodil Lindqvist, GDPRhub (2023), https://gdprhub.eu/index.php?title=CJEU_-_C-101/01_-_Bodil_Lindqvist.
3. Privacy Law Library: Bodil Lindqvist, Ctr. for Commc’n Governance, Nat’l L. Univ. Delhi, https://privacylibrary.ccgnlud.org/case/bodil-lindqvist (last visited July 7, 2026).
4. Omer Tene, After Safe Harbor: Is It Time to Close the Lindqvist Loophole?, Int’l Ass’n of Privacy Profs. (2016), https://iapp.org/news/a/after-safe-harbor-is-it-time-to-close-the-lindqvist-loophole.