Privacy Engine
The PrivacyEngine Team
01/10/15
European Court of Justice
Case C‑230/14
Weltimmo v Hungarian Data Protection Authority
REQUEST for a preliminary ruling under Article 267 TFEU from the Supreme Court of Hungary
Weltimmo, a company registered in Slovakia, runs a property dealing website concerning Hungarian properties. For that purpose, it processes the personal data of the advertisers. The advertisements are free of charge for one month but thereafter a fee is payable. Many advertisers sent a request by e-mail for the deletion of both their advertisements and their personal data as from that period. However, Weltimmo did not delete those data and charged the interested parties for the price of its services. As the amounts charged were not paid, Weltimmo forwarded the personal data of the advertisers concerned to debt collection agencies.
Those advertisers lodged complaints with the Hungarian Data Protection Authority (DPA) which declared that it was competent under Paragraph 2(1) of the Law on information, taking the view that the collection of the data concerned constituted processing of data or a technical operation for the processing of data concerning natural persons. Considering that Weltimmo had infringed the Law on information, the Hungarian DPA imposed on that company a fine of HUF 10 million (approximately EUR 32 000).
Weltimmo then brought an action before the Budapest administrative and labour court which held that the fact that that company did not have a registered office or branch in Hungary was not a valid argument in defence because the processing of data and the supply of data services relating to the Hungarian property concerned had taken place in Hungary. However, that court set aside the decision of the Hungarian DPA on other grounds, connected with the lack of clarity over some of the facts.
Weltimmo appealed on a point of law to the referring court, claiming that there was no need for further clarification of the facts, since, pursuant to Article 4(1)(a) of Directive 95/46, the Hungarian DPA in this case was not competent and could not apply Hungarian law in respect of a supplier of services established in another Member State. Weltimmo maintained that, under Article 28(6) of Directive 95/46, that authority should have asked the Slovak DPA to act in its place.
The Hungarian DPA submitted that Weltimmo had a Hungarian representative in Hungary, namely one of the owners of that company, who represented it in the administrative and judicial proceedings that took place in that Member State. The DPA added that Weltimmo’s Internet servers were probably installed in Germany or in Austria, but that the owners of that company lived in Hungary.
Since it had doubts concerning the determination of the applicable law and the powers of the Hungarian DPA under Articles 4(1) and 28 of Directive 95/46, the Supreme Court of Hungary decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling.
The European Court held:
In light of the objective pursued by Directive 95/46/EC, consisting in ensuring effective and complete protection of the right to privacy and in avoiding any circumvention of national rules, the presence of only one representative can, in some circumstances, suffice to constitute a stable arrangement if that representative acts with a sufficient degree of stability through the presence of the necessary equipment for the provision of the specific services concerned in the Member State in question.
In addition, in order to attain that objective, it should be considered that the concept of ‘establishment’, within the meaning of Directive 95/46, extends to any real and effective activity — even a minimal one — exercised through stable arrangements.
In the present case, the activity exercised by Weltimmo consists, at the very least, of the running of one or several property dealing websites concerning properties situated in Hungary, which are written in Hungarian and whose advertisements are subject to a fee after a period of one month. It must therefore be held that that company pursues a real and effective activity in Hungary.
This is a significant decision, especially for Ireland, in that it will affect multinational corporations whose headquarters are located in a particular European country and who have been operating on the assumption that they would only be subject to the Data Protection laws of that country alone. The Weltimmo ruling now establishes that these companies will also be answerable to the authorities of other Member States in which they operate a “real and effective activity”.
Moreover, the case, by setting a standard regarding the limitations of disparate national Data Protection laws under the current EU Directive, is yet another example of the progressive nature of EU Data Protection law which is set to be overhauled with the enactment of the General Data Protection Regulation later this month. The difference between a Directive and Regulation is that a Directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. A Regulation, meanwhile, is a binding legislative act and must be applied in its entirety across the EU.
It will be interesting to observe how the new Regulation, and the European and National Courts, address similar situations such as the one in Weltimmo as Data Protection laws and standards continue to evolve over the coming years.
We’ve got more coming…
Want to hear from us when we add new articles? Sign up for our newsletter and we'll email you every time we release a new article, as well as other resources.
