One of the great difficulties facing data protection lawyers is how Directive 95/46/EC copes with the internet age. How do you work out where processing has happened? How do you work out who is responsible? Where can you sue them or otherwise take action against them? What law applies (important given that the Directive has been implemented in different ways in different Member States)?
Article 4 provides some of the answer:
“1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;
(b) the controller is not established on the Member State’s territory, but in a place where its national law applies by virtue of international public law;
(c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.
2. In the circumstances referred to in paragraph 1 (c), the controller must designate a representative established in the territory of that Member State, without prejudice to legal actions which could be initiated against the controller himself.”
The decision of the CJEU Google Spain gave some consideration to these matters, but while it certainly established that one could pursue Google through it having a presence in a Member State, it did not really deal with the smaller fry.
However, the CJEU’s decision today in Case C-230/14 Weltimmo v Nemzeti (judgment of 1 October 2015) provides a bit more clarification. Weltimmo (as Anya’s post on the AG’s Opinion has previously discussed) is a company registered in Slovakia, but which the Hungarian data protection authority wished to fine for breaches of the Directive. Those breaches related to the activities of property dealing websites Weltimmo ran which advertised properties in Hungary and revealed various items of personal data of the property owners. What factors were relevant in working out whether Weltimmo was established in Hungary under Article 4?
Article 4, stressed the Court, was the key to determining the national law applicable: at [23]. The Directive had prescribed a broad territorial scope (see Google Spain): at [27]. In the particular context of the internet, said the Court without particularly expressing why there should be different tests for different types of business, when working out whether Weltimmo was also established in a State where it was not registered, one had consider “both the degree of stability of the arrangements and the effective exercise of the activities” in the light of “the specific nature of the economic activities” concerned: at [29]. (No mention of where there was not a clear economic activity.) An establishment can be shown by “any real and effective activity – even a minimal one – exercised through stable arrangements“: at [31].
What is relevant then? The presence of just one representative can be sufficient if acting with a sufficient degree of stability through the presence of the necessary equipment for the provision of the services (i.e. not necessarily where the servers are): at [30]. Running a website about properties in Hungary, written in Hungarian, which charges advertising fees constituted a real and effective activity in Hungary: at [32]. The presence of a representative in Hungary, who acts as a point of contact with the Slovak company and the data subjects, and a Hungarian bank account, and a Hungarian letter box for the business, were all capable of showing an establishment: at [33]. What is not relevant is the nationality of the data subjects: at [40] (which is consistent with the classic approach to jurisdiction under the Brussels I regime). The processing itself must take place in the context of the activities in Hungary, but the Court had no difficulty with that: at [38]. As a result, Hungarian law applied to Weltimmo: at [39].
This was all fact-specific of course, but it does give some fairly extensive guidance, and certainly indicates that any website aimed at a particular jurisdiction, plus some sort of physical presence of some sort, will be sufficient to amount to an establishment. Company registration elsewhere will not be an escape route.
There was also a second issue, which was technically obiter, about when a national regulator can take action against a data controller who may be subject to foreign laws. The CJEU strongly emphasised that it was the obligation of the regulator under Article 28 to take action within its own territory and to investigate every complaint made to it, irrespective of the applicable law: at [54]. What it cannot do, of course, is try to fine a controller not established in its own State: at [56]. So, if having investigated, the regulator reaches the conclusion that the controller is established elsewhere and subject to a foreign legal regime, it must ask the relevant national regulator to take over the case and impose any penalty based, in part, on the information provided between regulators: at [57]. Cross-border regulation might not yet be at a one-stop shop level, but it is meant to have teeth.
Weltimmo is a genuinely important decision and provides some very helpful guidance. By no means does it answer all of the questions, particularly outside of the internet, and it does not come close to the beginning of the end. But perhaps, following Google Spain, it is the end of the beginning.
Christopher Knight