On June 25, 2015, the advocate general of the Court of Justice of the European Union (“ECJ”) filed his opinion in the case 230/14, Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság (“Weltimmo”). According to the Advocate General, in order to determine which EU data protection law applies, authorities shall consider where the companies’ activity occurs, including the physical presence of one worker in a jusrisdiction. Another aspect discussed by the advocate general is the relationship between Member States’ data protection authorities and their powers.
Facts and main proceeding. Weltimmo s.r.o. is a Slovakian company hosting a real estate website. The website advertises Hungarian real estates. The advertising is free only for the first month. After that, Weltimmo charges a fee. Since several of the advertisers were not interested in using Weltimmo’s services after the first month, they asked the company to have their advertisement taken down. However, Weltimmo did not comply with the requests and charged them. The Nemzeti Adatvédelmi és Információszabadság hatóság, the Hungarian data protection authority (“DPA”) deemed to be competent and fined Weltimmo 10 million Hungarian Forints (around $35.000). The Fővárosi Közigazgatási és Munkaügyi Bíróság, the administrative court located in Budapest, annulled the decision for lack of facts.
On appeal, before the Kúria the Hungarian Supreme Court) Weltimmo claimed that the Hungarian DPA was not competent to issue a sanction and that because and Hungarian data protection law does not apply to service provider based in a different Member State. At the most, it should have been the Slovakian DPA to intervene.
The Hungarian DPA deemed to be competent according to section 28.6, Directive 9/46/EC because one of Weltimmo’s representative is Hungarian and who is also one of the company’s owners. In addition, both of Weltimmo’s owners have their residency in Hungary.
Preliminary questions before the ECJ. On May 12, 2014, the Kúria referred to the ECJ several preliminary questions asking, among other things, whether Article 28.1, Directive 95/46/EC (concerning the role of the local Data Protection Authority), can be interpreted as meaning that the data protection law of a Member State is applicable in its territory “to a situation in which a data controller runs a property-dealing website established only in another Member State and also advertises properties situated in the territory of that first Member State and the property owners have forwarded their personal data to a facility (server) for data storage and data processing belonging to the operator of the website in that other Member State.”
Furthermore, the Kúria asked the CJEU clarifications to establish which one is the competent data protection authority, which law can it apply and which are its powers, and, in particular, if it can issue fines. It specifically asked whether Article 4.1(a), Directive 95/46/EC (concerning the role of the local DPA), can be interpreted as meaning that the Hungarian DPA
may not apply the Hungarian law on data protection, as national law, to an operator of a property dealing website established only in another Member State, even if it also advertises Hungarian property whose owners transfer the data relating to such property probably from Hungarian territory to a facility (server) for data storage and data processing belonging to the operator of the website?
The advocate general opines that
there is no reason to believe that the Hungarian DPA cannot apply the Hungarian law to a data controller established exclusively in another Member State. The definition of establishment shall refer to a stable organization – notwithstanding its legal form – through which an effective and real exercise of activity is carried out. Even a single worker can constitute an establishment if it allows the company to reach a sufficient level of stability by providing enough human and technical means to allow the commercial entity to offer its services.
Other factors, such as the place where the data are uploaded, the citizenship of the parties, the domiciles of the data controller’s owners or the fact that the services are offered by the controller to the advantage of citizens of a different Member State shall not be crucial to determine the applicable law. Off course, these factors could aid in determining whether the activity is real and actual to the effects of the place of establishment, or whether the data processing was carried out by such establishment.
In addition, the advocate general explained that
if the national court finds out that – according to Article 4.1, Directive 95/46/EC – her national law is not applicable, Article 28.6, Directive 95/46/EC shall be interpreted in the sense that the DPA of the Member State whose law is applicable has the power to sanction violations relating to data processing. Notwithstanding the above, the local DPA will still have all powers conferred to it by Article 28.3, as implemented by its national law.
Even though the ECJ is not bound by the Advocate General’s opinion, the latter provides the ECJ with “reasoned submissions” for a decision that is expected within 4-6 months and will clarify Directive 95/46/EC on this matter. The opinion is also important for companies because it provides a useful insight to determine the applicable data protection law in an era when many commercial activities can be carried out by an individual working remotely on her laptop.
In addition, the debate is interesting in light of the Proposed Data Protection Regulation and the rules that it will set forth to regulate the interaction among the various European data protection supervisors. As a matter of fact, the debate on the topic is still open and it could be influenced by Weltimmo, as well as other case law like like Schrems (C 362/14), and Google Spain (C 131/12).
More information on Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság is available at http://curia.europa.eu…
The Advocate General’s conclusions are available (in several languages) at http://curia.europa.eu…
For more info, Francesca Giannoni-Crystal
Follow us on& Like us on