CJEU - C-230/14 - Weltimmo

CJEU - C‑230/14 Weltimmo
Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 28(1) Directive 95/46/EC Article 28(3) Directive 95/46/EC Article 4(1)(a) Directive 95/46/EC Article 28(6) Directive 95/46/EC
Decided:	01.10.2015
Parties:	Weltimmo s. r. o. Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian DPA)
Case Number/Name:	C‑230/14 Weltimmo
European Case Law Identifier:	ECLI:EU:C:2015:639
Reference from:	Supreme Court (Hungary)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	Frederick Antonovics

In progress

English Summary

Facts

Weltimmo was a company registered in Slovakia that ran a property dealing website concerning Hungarian properties. For that purpose, it processed the personal data of advertisers. The advertisements were free of charge for one month but a fee had to be paid once this time had passed. Many advertisers sent a request by e-mail for the deletion of both their advertisements and their personal data as from that period. However, Weltimmo did not delete those data and charged the interested parties for the price of its services. As the amounts charged were not paid, Weltimmo forwarded the personal data of the advertisers concerned to debt collection agencies.

These advertisers lodged complaints with the Hungarian data protection authority, which fined the company HUF 10 million (approximately €32,000). Weltimmo appealed the fine before the Budapest administrative and labour court, which set aside the DPA's decision on the basis that certain facts were unclear. The company then appealed this decision to the Kúria submitting that there was no need for further clarification of the facts, since, pursuant to Article 4(1)(a) of Directive 95/46, the Hungarian DPA in this case was not competent and could not apply Hungarian law in respect of a supplier of services established in another Member State. Weltimmo also maintained that, under Article 28(6) of Directive 95/46, the Hungarian DPA should have asked the Slovak DPA to act in its place.

The Kúria had doubts concerning the determination of the applicable law and the powers of the Hungarian data protection authority under Articles 4(1) and 28 of Directive 95/46, and therefore decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling:

1. Can Article 28(1) of Directive 95/46 be interpreted as meaning that the provisions of national law of a Member State are applicable in its territory to a situation where a data controller runs a property dealing website established only in another Member State and also advertises properties situated in the territory of that first Member State and the property owners have forwarded their personal data to a facility (server) for data storage and data processing belonging to the operator of the website in that other Member State?
2. Can Article 4(1)(a) of [Directive 95/46], read in conjunction with recitals 18 to 20 of its preamble and Articles 1(2) and 28(1) thereof, be interpreted as meaning that the Hungarian [data protection authority] may not apply the Hungarian law on data protection, as national law, to an operator of a property dealing website established only in another Member State, even if it also advertises Hungarian property whose owners transfer the data relating to such property probably from Hungarian territory to a facility (server) for data storage and data processing belonging to the operator of the website?
3. Is it significant for the purposes of interpretation that the service provided by the data controller who operates the website is directed at the territory of another Member State?
4. Is it significant for the purposes of interpretation that the data relating to the properties in the other Member State and the
5. Is it significant for the purposes of interpretation that the personal data relating to those properties are the personal data of citizens of another Member State?
6. Is it significant for the purposes of interpretation that the owners of the undertaking established in Slovakia live in Hungary?
7. If it appears from the answers to the above questions that the Hungarian data protection authority may act but must apply the law of the Member State of establishment and may not apply national law, must Article 28(6) of [Directive 95/46] be interpreted as meaning that the Hungarian data protection authority may only exercise the powers provided for by Article 28(3) of [Directive 95/46] in accordance with the provisions of the legislation of the Member State of establishment and accordingly may not impose a fine?
8. May the term “adatfeldolgozás” (technical manipulation of data) used in both Article 4(1)(a) and in Article 28(6) of the [Hungarian version of Directive 95/46 to translate ‘data processing’] be considered to be equivalent to the usual term for data processing, “adatkezelés”, used in connection with that directive?’

Holding

Questions 1-6

The CJEU examined the first to sixth questions together, asking the question "whether Articles 4(1)(a) and 28(1) of Directive 95/46 must be interpreted as permitting, in circumstances such as those at issue in the main proceedings, the data protection authority of a Member State to apply its national law on data protection with regard to a data controller whose company is registered in another Member State and who runs a property dealing website concerning properties situated in the territory of the first of those two States. In particular, the referring court asks whether it is significant that that Member State is the Member State:

• at which the activity of the controller of the personal data is directed,
• where the properties concerned are situated,
• from which the data of the owners of those properties are forwarded,
• of which those owners are nationals, and
• in which the owners of that company live."

Applicable law

First, the Court held that the national law applicable to Weltimmo must be determined in light of Article 4 of Directive 95/46, which sets out that each Member State has to apply the national provisions it adopts pursuant to Directive 95/46 to the processing of personal data where the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State. It stated this notion of 'in the context of the activities of an establishment' should be interpreted broadly, and that EU legislators intended for the territorial scope of Directive 95/46 to be "particularly broad".

Concept of 'establishment'

Second, the Court held that the concept of ‘establishment’ should be defined in a flexible manner in light of Recital 19 in the preamble to Directive 95/46. It found that in order to determine whether a company/data controller has an establishment (within the meaning of Directive 95/46) in a Member State other than the one it is registered in, one must consider (1) the degree of stability of the arrangements and (2) the effective exercise of activities in that other Member State. These must be assessed with particular regards to the (1) specific nature of the economic activities and (2) the provision of services concerned. It stated that this test is particularly applicable to exclusively web-based companies.

Then, the Court asserted that the concept of establishment effectively "extends to any real and effective activity — even a minimal one — exercised through stable arrangements." It explained that Weltimmo could therefore be said to have (subject to an assessment by the referring court) an establishment within the meaning of Article 4(1)(a) of Directive 95/46 in Hungary because it (1) ran "property dealing websites concerning properties situated in Hungary, which are written in Hungarian and whose advertisements are subject to a fee after a period of one month", (2) had a representative in the country who dealt with advertisers and pursued them to recover the debts it considered they owed the company, and (3) had a Hungarian bank account.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!