On Thursday the Court of Justice of the European Union issued another decision on the interpretation of Direction 95/46/EC – the Data Protection Directive. The case was on reference from the Hungarian Supreme Court and asked a number of questions around when a data controller is established in a particular member state for the purposes of the Directive.
Factual Background
Weltimmo s.r.o is a company registered in Slovakia under Slovakian law. It operates one or more property websites which are written in Hungarian and feature Hungarian properties. The Company offered one month’s free advertising before beginning to charge its customers for the use of its service. Somewhat unsurprisingly a lot of people took advantage of the one month free offer and then sought to have their adverts and personal data erased at the conclusion of the free month. Weltimmo did not delete the advertisements or their personal data and instead charged its customers for the use of its services. Those charges went unpaid and Weltimmo passed details of the ‘debtors’ onto debt collection agencies in Hungary.
Complaints were made to the Hungarian Data Protection Authority who found that Weltimmo had breached Data Protection law. A fine of approximately €32,000 was imposed on Weltimmo. Weltimmo appealed and the fine was overturned; however, it was determined that Weltimmo was established in Hungary for the purposes of Hungary’s data protection law. Weltimmo disagreed and appealed to the Hungarian Supreme Court, who made a reference to the Court of Justice of the European Union.
Other important facts narrated in the Court’s decision are: that the company had a Hungarian bank account; it had a letter box in Hungary that was used for its every day affairs; and it had a representative in Hungary who sought to negotiate settlements of the unpaid debts.
Court’s decision
The Court made reference to Google Spain and stated that “establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements and that the legal form of such an establishment, whether simply a branch or subsidiary with a legal personality.” [28] The Court went on to say that there is a “flexible definition of the concept of ‘establishment’, which departs from a formalistic approach whereby undertakings are established solely in the place where they are registered.” [29]
Essentially what the Court is stating here is that there may be a difference between where a company is registered and where it is established for the purposes of data protection law. It is necessary to look at where the exercise of activity is and not just about where it has a physical presence by way of a building or a registered office. A company registered in Scotland, but which deals exclusively in the Republic of Ireland might find itself subject to the data protection law of the Republic of Ireland as opposed to that of the United Kingdom.
In the present case, the Court noted at paragraph [32] that “the activity exercised by Weltimmo consists, at the very least, of the running of one or several property dealing websites concerning properties situated in Hungary, which are written in Hungarian and whose advertisements are subject to a fee after a period of one month. It must therefore be held that the company pursues a real and effective activity in Hungary.”
In Google Spain the Court held that the Directive does not require the processing of personal data to be carried out by the establishment, but only that it be carried out “in the context of the activities” of the establishment (Google Spain, [52]). The Court considered that there was “no doubt” that this was the case in the Weltimmo case. [38] Therefore, unless any of the facts concerning bank accounts, representatives and letter boxes proved to be incorrect (matters which it is for the national court to determine) Weltimmo is established in Hungary for the purposes of data protection law.
The Court did stress that the owners of the properties being advertised had Hungarian nationality was of no relevance in determining the question of which national law was applicable. [40]
The referring court had also sought guidance from the Court concerning the imposition of sanctions. The Court emphasised the responsibility of national authorities to take action within their own territory and that they may investigate any complaints made to it where the national law of another member state is applicable. [54] However, the Court was equally clear that a national authority cannot impose a sanction upon a data controller who is not established in their territory. [56] This is fairly obvious and stems from the sovereignty of nations. In those circumstances the national authority that has investigated the matter should pass on the case to the national authority that has jurisdiction to impose a penalty seeking that they do so; based where necessary on any information supplied to that national authority by the authority who initially investigated the complaint. [57]
For example, the Information Commissioner’s Office cannot take action against Facebook because it is not established in the UK; however, it may investigate a complaint from someone in the UK as to how Facebook has processed their personal data before passing it to the Irish Data Protection Commissioner, who does have jurisdiction by virtue of Facebook being established in the Republic of Ireland. It would then be for the Irish Data Protection Commissioner to establish whether Facebook has broken Irish Law in relation to data protection and to then impose penalties in accordance with Irish Law, making use of the information passed to it by the ICO.
This is an important judgment that gives very good and strong advice on handling cross-border data protection issues where the internet is involved. It stresses the need for data protection authorities across Europe to work in co-operation to ensure the rights of data subjects are protected whilst personal data is being processed. The coming reforms (expected to be in force middle – late 2018) will not move away from that; indeed, with the proposed ‘one-stop’ regulation it will only increase that requirement.
prout de jure 