CJEU - C‑230/14 - Weltimmo - GDPRhub

CJEU - C-230/14 Weltimmo
Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 28(1) Directive 95/46/ECArticle 28(3) Directive 95/46/ECArticle 4(1)(a) Directive 95/46/ECArticle 28(6) Directive 95/46/EC
Decided:	01.10.2015
Parties:	Weltimmo s. r. o. Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian DPA)
Case Number/Name:	C-230/14 Weltimmo
European Case Law Identifier:	ECLI:EU:C:2015:639
Reference from:	Supreme Court (Hungary)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	Frederick Antonovics

Contents

• 1 English Summary
  • 1.1 Facts
  • 1.2 Holding
    • 1.2.1 Questions 1-6
      • 1.2.1.1 Applicable law
      • 1.2.1.2 Concept of 'establishment'
      • 1.2.1.3 Was the processing carried out 'in the context of [Weltimmo's] activities' in Hungary?
      • 1.2.1.4 Answer to questions 1-6
    • 1.2.2 Question 7
    • 1.2.3 Question 8
• 2 Comment
• 3 Further Resources

English Summary

Facts

Weltimmo was a company registered in Slovakia that ran a property dealing website concerning Hungarian properties. For that purpose, it processed the personal data of advertisers. The advertisements were free of charge for one month but a fee had to be paid once this time had passed. Many advertisers sent a request by e-mail for the deletion of both their advertisements and their personal data as from that period. However, Weltimmo did not delete those data and charged the interested parties for the price of its services. As the amounts charged were not paid, Weltimmo forwarded the personal data of the advertisers concerned to debt collection agencies.

These advertisers lodged complaints with the Hungarian data protection authority, which fined the company HUF 10 million (approximately €32,000). Weltimmo appealed the fine before the Budapest administrative and labour court, which set aside the DPA's decision on the basis that certain facts were unclear. The company then appealed this decision to the Kúria submitting that there was no need for further clarification of the facts, since, pursuant to Article 4(1)(a) of Directive 95/46, the Hungarian DPA in this case was not competent and could not apply Hungarian law in respect of a supplier of services established in another Member State. Weltimmo also maintained that, under Article 28(6) of Directive 95/46, the Hungarian DPA should have asked the Slovak DPA to act in its place.

The Kúria had doubts concerning the determination of the applicable law and the powers of the Hungarian data protection authority under Articles 4(1) and 28 of Directive 95/46, and therefore decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling:

1. Can Article 28(1) of Directive 95/46 be interpreted as meaning that the provisions of national law of a Member State are applicable in its territory to a situation where a data controller runs a property dealing website established only in another Member State and also advertises properties situated in the territory of that first Member State and the property owners have forwarded their personal data to a facility (server) for data storage and data processing belonging to the operator of the website in that other Member State?
2. Can Article 4(1)(a) of [Directive 95/46], read in conjunction with recitals 18 to 20 of its preamble and Articles 1(2) and 28(1) thereof, be interpreted as meaning that the Hungarian [data protection authority] may not apply the Hungarian law on data protection, as national law, to an operator of a property dealing website established only in another Member State, even if it also advertises Hungarian property whose owners transfer the data relating to such property probably from Hungarian territory to a facility (server) for data storage and data processing belonging to the operator of the website?
3. Is it significant for the purposes of interpretation that the service provided by the data controller who operates the website is directed at the territory of another Member State?
4. Is it significant for the purposes of interpretation that the data relating to the properties in the other Member State and the
5. Is it significant for the purposes of interpretation that the personal data relating to those properties are the personal data of citizens of another Member State?
6. Is it significant for the purposes of interpretation that the owners of the undertaking established in Slovakia live in Hungary?
7. If it appears from the answers to the above questions that the Hungarian data protection authority may act but must apply the law of the Member State of establishment and may not apply national law, must Article 28(6) of [Directive 95/46] be interpreted as meaning that the Hungarian data protection authority may only exercise the powers provided for by Article 28(3) of [Directive 95/46] in accordance with the provisions of the legislation of the Member State of establishment and accordingly may not impose a fine?
8. May the term “adatfeldolgozás” (technical manipulation of data) used in both Article 4(1)(a) and in Article 28(6) of the [Hungarian version of Directive 95/46 to translate ‘data processing’] be considered to be equivalent to the usual term for data processing, “adatkezelés”, used in connection with that directive?’

Holding

Questions 1-6

The CJEU examined the first to sixth questions together, asking the question "whether Articles 4(1)(a) and 28(1) of Directive 95/46 must be interpreted as permitting, in circumstances such as those at issue in the main proceedings, the data protection authority of a Member State to apply its national law on data protection with regard to a data controller whose company is registered in another Member State and who runs a property dealing website concerning properties situated in the territory of the first of those two States. In particular, the referring court asks whether it is significant that that Member State is the Member State:

• at which the activity of the controller of the personal data is directed,
• where the properties concerned are situated,
• from which the data of the owners of those properties are forwarded,
• of which those owners are nationals, and
• in which the owners of that company live."

Applicable law

First, the Court held that the national law applicable to Weltimmo must be determined in light of Article 4 of Directive 95/46, which sets out that each Member State has to apply the national provisions it adopts pursuant to Directive 95/46 to the processing of personal data where the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State. It stated this notion of 'in the context of the activities of an establishment' should be interpreted broadly, and that EU legislators intended for the territorial scope of Directive 95/46 to be "particularly broad".

Concept of 'establishment'

Second, the Court held that the concept of ‘establishment’ should be defined in a flexible manner in light of Recital 19 in the preamble to Directive 95/46. It found that in order to determine whether a company/data controller has an establishment (within the meaning of Directive 95/46) in a Member State other than the one it is registered in, one must consider (i) the degree of stability of the arrangements and (ii) the effective exercise of activities in that other Member State. These must be assessed with particular regards to the (1) specific nature of the economic activities and (iii) the provision of services concerned. It stated that this test is particularly applicable to exclusively web-based companies.

Then, the Court asserted that the concept of establishment effectively "extends to any real and effective activity — even a minimal one — exercised through stable arrangements." It explained that Weltimmo could therefore be said to have (subject to an assessment by the referring court) an establishment within the meaning of Article 4(1)(a) of Directive 95/46 in Hungary because it (i) ran "property dealing websites concerning properties situated in Hungary, which are written in Hungarian and whose advertisements are subject to a fee after a period of one month", (ii) had a representative in the country who dealt with advertisers and pursued them to recover the debts it considered they owed the company, and (iii) had a Hungarian bank account.

Was the processing carried out 'in the context of [Weltimmo's] activities' in Hungary?

The Court first restated that the processing at the centre of the case consisted, "inter alia, of the publication, on Weltimmo’s property dealing websites, of personal data relating to the owners of those properties and, in some circumstances, of the use of those data for the purpose of the invoicing of the advertisements after a period of one month." It referred to the Lindqvist and Google Spain cases to find that "the operation of loading personal data on an Internet page must be considered to be ‘processing’ within the meaning of Article 2(b) of Directive 95/46." In light of these findings, it held that this processing was carried out in the context of Weltimmo's activities in Hungary.

Answer to questions 1-6

In sum, the CJEU answered the questions as follows:

• "Article 4(1)(a) of Directive 95/46 must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out;
• in order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned;
• by contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant."

Question 7

The Court first held that because DPAs have to consider claims lodged by any person concerning the protection of his rights and freedoms in regard to the processing of personal data under Article 28(4) of Directive 95/46, the Hungarian DPA had the competency to hear claims lodged by the advertisers of properties on Weltimmo.

Second, it examined the powers of the DPA per Articles 28(1), (3) and (6) of Directive 95/46. It found that "where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act."

Question 8

"The answer to the eighth question is that Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing)"

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!