Data Protection: The Cjeu Clarifies The Applicable Constabulary Together With Jurisdiction

Lorna Woods, Professor of Internet Law, University of Essex*

The CJEU lately gave judgment inwards the Weltimmo case, concerning the attain of information protection supervisors, ruling that i Member State’s supervisor tin make got jurisdiction on organisations mainly established beyond the edge of that State. This ruling could make got an comport upon on ii key issues nether give-and-take every bit regards the proposed information protection Regulation: the external compass of that Regulation (discussed here) together with the powers of national information protection government together with the relationships betwixt them - especially whether at that spot should endure a 'one-stop shop' for regulation (discussed here).

Facts 

Weltimmo is a companionship registered inwards Slovakia. It runs a website advertising the sale of properties inwards Republic of Hungary and, for that purpose, it processes the personal information of the advertisers of the property. Many advertisers sent a asking past times e-mail for the deletion of both their advertisements together with their personal information but Weltimmo did non delete such information together with charged the advertisers for the cost of its services. As the sums claimed were non paid, Weltimmo forwarded the personal information of the advertisers to debt collection agencies.  The advertisers complained to the Hungarian information protection office. 

Article 28(6) of the Data Protection Directive specifies:

Each supervisory potency is competent, whatever the national constabulary applicable to the processing inwards question, to exercise, on the territory of its ain Member State, the powers conferred on it inwards accordance amongst paragraph 3. Each potency may endure requested to occupation its powers past times an potency of roughly other Member State.

Weltimmo argued the Hungarian supervisor did non make got jurisdiction but should instead make got referred the affair to the Slovakian supervisory authority.  The Hungarian potency referred, however, to Article four of the Directive, which states:

Each Member State shall use the national provisions it adopts pursuant to this Directive to the processing of personal information where:

(a) the processing is carried out inwards the context of the activities of an institution of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must make got the necessary measures to ensure that each of these establishments complies amongst the obligations pose downwards past times the national constabulary applicable….

The interrogation together with hence was where Weltimmo was established.  In whatever event, no affair what the applicable law, the Hungarian potency took the stance that nether Article 28 it had jurisdiction.  It was these questions of interpretation that were referred to the Court of Justice.

Judgment

The Court's judgment broadly follows the approach of the Advocate General (Opinion 25^thJune 2015).  The Court determined that the national constabulary applicable to the controller inwards honor of that processing must endure determined inwards the low-cal of Article 4; Article 28 deals amongst role together with powers of the national authorities. So the key interrogation was whether the processing was 'in the context of activities of an establishment' – together with to ensure protection of primal rights, this concept should endure interpreted broadly. In this, the Court referred to Google Kingdom of Spain (discussed here). Drawing on the approach of the Advocate General, the Court noted that the pregnant of 'establishment' hither is a wide together with flexible concept – together with specifically non merely the interrogation of where the information controller is registered.  The examination relates to:

both the marking of stability of the arrangements together with the effective occupation of activities inwards that other Member State must endure interpreted inwards the low-cal of the specific nature of the economical activities together with the provision of services concerned. This is especially truthful for undertakings offering services alone over the Internet. [para 29]

The Court emphasised that the concept of 'establishment' extends to whatever existent together with effective activity, fifty-fifty a minimal one, exercised through stable arrangements. Specifically, depending on the circumstances, the presence of fifty-fifty i instance tin suffice.  In this case, Weltimmo was sure enough established inwards Hungary.  Not only was at that spot a representative, a banking concern concern human relationship together with contact details inwards Hungary, but Weltimmo pursues a existent together with effective action there. 

Having determined that at that spot is an establishment, the side past times side interrogation is whether the information processing takes house inwards connective amongst the activities carried out through that establishment.  Again, nosotros encounter the Court referring to its reasoning in Google Spain: that the processing is non required to endure 'by' the establishment, but instead the broader concept of 'in the context of' activities carried out through it. The Court found that expression satisfied here. In hence doing, it noted that the nationality of those whose information was processed is not relevant.  The analysis is all almost the information controller non the information dependent area here.  This reasoning suggests that the applicable constabulary could endure that of Republic of Hungary but the Court directed the national courtroom to verify the finding of facts.

The Court continued that, inwards the trial of the application of the constabulary of roughly other Member State, Article 28 of the Directive would come upward into play.  According to that provision, each potency has the responsibleness together with the powerfulness to ensure compliance on that territory amongst information protection rules, that is, it has jurisdiction to act.  Obviously, this is unlike phraseology than that found inwards Article four but the Court did non address the interrogation of what 'on the territory of its ain Member State' agency (which may non endure clear inwards a digital context). Instead it held that where a complaint is referred to a national authority, it may investigate whatever the applicable law.  As the Advocate General pointed out, the powers of intervention of the supervisory potency must endure exercised inwards compliance amongst the territorial sovereignty of the other Member U.S. of A. together with honor for the dominion of law, amongst the final result that a national potency cannot impose penalties exterior the territory of its ain State.  In such a province of affairs the potency should asking the cooperation of the relevant national authority, every bit foreseen past times Article 28, to ensure that the rules are enforced.

Comment

The upshot of this conclusion is that it is clear that at that spot is no one-stop-regulation approach currently inwards effect.  This agency that a concern amongst operations inwards to a greater extent than than i Member State may endure dependent area to multiple interpretations of the information protection rules.  In determining which together with how many government make got competence, the key interrogation becomes that of 'establishment'.  While the information subjects together with their nationality are non relevant, the Court has non taken a formal legal approach.  We tin await at whether at that spot are employees or a physical representation, but also concern practise tin endure taken into account. It is important that the Court notes the specificities of Internet businesses.  Implicitly, if the concern is reaching into the territory on an on-going basis, physical representation would endure unnecessary to observe 'establishment'.

This approach is re-affirmed past times the Court's re-iteration of its stance in Google Spain with regard to the connective betwixt the processing together with the business. The Court is taking a wide stance of whether such connective volition arise; arguing points based on legal shape volition non assist here. That could make got consequences for companies such every bit Facebook which are currently clinging to the declaration that they are regulated past times Republic of Ireland to endeavor to defend claims from government across the EU.  On the footing of Weltimmo, that mightiness non right away endure such a expert argument.  This expansive compass of applicable constabulary may also hateful that the province of affairs inwards Article 28(6) volition occur less frequently.

Looking to a greater extent than generally, the reasoning in Weltimmo suggests that the Court is sticking to its stance in Google Spain, emphasising the primal nature of privacy together with information protection together with the cry for to translate legal concepts broadly to ensure an adequate protection for those rights.  This tendency has, of course, since been confirmed past times the subsequent judgment inwards Schrems. It remains to endure seen whether the judgment inwards Weltimmo has an comport upon upon the planned Regulation.

*This is based on a weblog post previously published on the SCL Blog, together with republished amongst form permission

Photo credit: DC Comics; Meme: Steve Peers

Share this post