Blog

2015. October 22.

The ECJ’s milestone decision on the territorial scope of the Directive theWeltimmo case


On 1 October 2015 the ECJ published its decision in case No. C-230/2014[1]. In the decision the ECJ followed the argumentation of Advocat General Pedro Cruz Villalón[2] and came to the conclusion that the principle of establishment should be applied by the authorities of the Member States, and consequently a data controller could be investigated solely in the Member State where it has its established office.

The so called Weltimmo case will be an important reference and precedent regarding the interpretation of the territorial scope of the Directive[3]. The argumentation of the court is particularly important for companies providing service on or through the Internet.

  1. Facts

1.1 History and backgound of the case

Weltimmos.r.o. was a company registered in Slovakia, operating several web sites[4]for real estate advertisements. The language of the web site is Hungarian and its servers are located in another Member State (Austria). No Hungarian company belongs to Weltimmo.  In the Weltimmo case[5], NAIH, the Hungarian Data Protection Authority[6] imposed its highest fine on a Slovakian company (Weltimmos.r.o. as defendant)[7]. The national procedure was relatively difficult to follow, since the first decision of the NAIH[8] was overruled by the administrative court for procedural reasons[9], however, it stated that the NAIH was right to find that it has competence over the case[10]. Although Weltimmo “won” the administrative court procedure, it appealed the judgment and asked the Supreme Court of Hungary to state that the NAIH did not have competence and jurisdiction over the case.

  • Decision of the national DPA

The NAIH also stated in the decision that the fact that Weltimmo had handed over the data of the non-paying users to private executors qualifies as unlawful transfer of personal data. This conclusion gave an end to the evergreen dispute of Hungarian law: whether the private executors are (sui generis) data controllers or they are just acting on behalf of the data controller in the position of a technical data processor. In the decision NAIH had taken the position that the executors are sui generis data controllers and the consent from the debtor would be required for their activity[11]. It is important that in the DPA’s conclusion Weltimmo is subject to Slovakian data protection law.

1.3. Decision of the First Instance Court

Weltimmo appealed the decision, but not only on the merits. It also stated that in its opinion NAIH has no jurisdiction. It cited the own Bylaw of the authority and also made a direct reference to article 4 (1) of the Directive together with the practice of the Article 29 Working Party. The court held that the web site of Weltimmo contains data of Hungarian real estates, which belong to Hungarian citizens. The first instance court stated that “article 4 (1) of the Directive does not have direct effect to Hungary” and “it is not relevant whether Weltimmo has a registered seat or servers in Hungary since it did not restrict the registration and data collecting activity from Hungary”.

1.4. Questions of the National Curiae

The Supreme Court (National Curiae) ex officio turned to the ECJ regarding an ongoing case with seven questions about whether the NAIH had authority over a company registered in another Member State and without having any presence in Hungary. The NAIH filed its comments to the ECJ mainly stating that, if the ECJ stated that article 4 (1) of the directive applies, that would allow a so called “forum shopping”, which would allow the defendants to opt out from a national law very easily.

  1. Arguments of the Parties

 

The Hungarian DPA made clear during the procedure that in its view the real activity of Wetimmo is in Hungary and the registered office is just an administrative basis for it: Weltimmo did not carry out any activity in Slovakia; Weltimmo developed two property dealing websites, written exclusively in Hungarian; it opened a bank account in Hungary and had a letter box in that Member State for its everyday business affairs. Moreover, the advertisers (data subjects) themselves not only had to enter the data relating to their properties on Weltimmo’s website, but also had to delete those data from that website if they did not want those data to continue to appear on the website after the end of the one-month period mentioned above.

  1. Decision of the ECJ
    • Concept of Establishment

The ECJ came to the conclusion that Weltimmo’s activity can be considered as establishment in Hungary[12].

The ECJ highlighted that the issue is, in essence, whether Articles 4(1)(a) and 28(1) of Directive 95/46 must be interpreted as permitting the data protection authority of a Member State to apply its national law on data protection with regard to a data controller whose company is registered in another Member State and who runs a property dealing website concerning properties situated in the territory of the first of those two States.

In its answer the ECJ came to the conclusion that the national law applicable to the controller in respect of that processing must therefore be determined not in the light of Article 28 of Directive 95/46, but in the light of Article 4 of that directive[13]. To this extent the ECJ applied the same test as laid down by the Google-case and followed the conclusion of the AG. As the Advocate General observed[14], the definition of the concept of ‘establishment’ is flexible and departs from a formalistic approach whereby undertakings are established solely in the place where they are registered. In order to establish whether a company, the data controller, has an establishment, within the meaning of Directive 95/46, in a Member State other than the Member State or third country where it is registered, both the degree of stability of the arrangements and the effective exercise of activities in that other Member State must be interpreted in the light of the specific nature of the economic activities and the provision of services concerned. The court highlighted that this conclusion is particularly true for undertakings offering services exclusively over the Internet.

The subsequent step of the test applied by the court was to decide whether the processing of personal data at issue is carried out ‘in the context of the activities’ of that establishment. The ECJ found that the processing at issue is, inter alia, of the publication, on Weltimmo’s property dealing websites, of personal data relating to the owners of those properties and, in some circumstances, of the use of those data for the purpose of the invoicing of the advertisements after a period of one month. In this respect, the Court highlighted that the operation of loading personal data on an Internet page must be considered to be ‘processing’ within the meaning of Article 2(b) of Directive. 

  • Applicable national law

The ECJ came to the conclusion that Hungarian law may be applied to the data processing by Weltimmo. 

The Hungarian court referred in particular to Slovak and Hungarian law, Slovak law being the law of the Member State in which the controller of the personal data concerned is registered and Hungarian law being the law of the Member State mentioned by the websites at issue in the main proceedings, in the territory of which the properties forming the subject-matter of the published advertisements are situated. In the ECJ’s view, the national law applicable to the controller in respect of that processing must be determined not in the light of Article 28 of the Directive but in the light of Article 4.

Since the processing is carried out in the context of the activities of that establishment and that Article 4(1)(a) of Directive 95/46 permits, in a situation such as that at issue in the main proceedings, the application of the Hungarian law on the protection of personal data, whilst the nationality of the data subjects is irrelevant.

  1. Investigation powers of the Hungarian Authority (iuspuniendi)

The ECJ came to the conclusion that when a supervisory authority receives a complaint, in accordance with Article 28(4) of Directive 95/46, that authority may exercise its investigative powers irrespective of the applicable law and before even knowing which national law is applicable to the processing in question.

However, if a national authority reaches the conclusion that the law of another Member State is applicable, it cannot impose penalties outside the territory of its own Member State. “In such a situation, it must, in fulfillment of the duty of cooperation laid down in Article 28(6) of that directive, request the supervisory authority of that other Member State to establish an infringement of that law and to impose penalties if that law permits, based, where necessary, on the information which the authority of the first Member State has transmitted to the authority of that other Member State”[15].

In a situation such as that at issue in the main proceedings, if the applicable law is that of a Member State other than Hungary, the Hungarian Data Protection Authority will not be able to exercise the powers to impose penalties which Hungarian law has conferred on it.

[1]http://curia.europa.eu/juris/document/document.jsf?text=&docid=154887&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=319558

[2]Weltimmo s.r.o. v. NAIH (National Authority for Data Protection and Freedom of Information Hungary) E.C.J., No. C-230/14, advocate general recommended opinion 6/25/15). The Hungarian version is available:  http://curia.europa.eu/juris/celex.jsf?celex=62014CC0230&lang1=hu&type=TXT&ancre=

[3] DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

[4] ingatlanbazar.com, ingatlandepo.com

[5] For Hungarian language commentary please see, Dr. András Jóri: The Weltimmo case available at  http://www.jema.hu/article.php?c=257

[6] www.naih.hu

[7] Worth to note that the websites have already been investigated by several Hungarian authorities. In December 2011 the Hungarian Competition Authority imposed EUR 20,000 on the defendant and stated that it had violated the Competition Act with its behavior, since the company offered free services but invoiced high fees after the expiry of a trial period. The scope of the Hungarian legislation covers any communication “aiming” the territory of Hungary. It is the consistent practice of the Hungarian competitionand consumer protection authorities that any Hungarian language web site may be investigated under the laws of Hungary. Also, the competition authority filed a class action against the company requesting the competent court to declare the terms and conditions of the company invalid. The court agreed with the Competition Authority and ruled that certain clauses of the terms applied by these entities were unfair, accordingly it also declared these clauses invalid.

[8] http://www.naih.hu/files/510_2012_jogellenes-adatkezeles-webes-tevekenyseg.pdf

[9] http://www.naih.hu/files/FKMB_2K29_113_2013_3weltimmo-itelet.pdf

[10] The NAIH repeated its procedure, rectified the procedural mistakes and adopted the same decision.

[11] This conclusion can be questioned, in particular in light of the provisions of article 7 of the Directive, which provides for the legal ground for data controlling without consent (or after the withdrawal of such consent) if it is necessary for the legal interest of the data controller. In our conclusion, debt collection obviously falls under the legal interests clause of the directive and therefore the handover of clients data to a private executor would not qualify as unlawful data processing under the European law.

[12] Point 32 and 38: „In the present case, the activity exercised by Weltimmo consists, at the very least, of the running of one or several property dealing websites concerning properties situated in Hungary, which are written in Hungarian and whose advertisements are subject to a fee after a period of one month. It must therefore be held that that company pursues a real and effective activity in Hungary”.

[13] Point 23 of the judgement

[14] points 28 and 32 to 34 of his opinion

[15] Point 57.