That has led the CJEU to the conclusion that the entrepreneur-controller established in one Member State may be subject to the data protection legislation of another Member State, if it pursues on the territory of such other state a real and effective activity (even if small and regardless of its legal form, as long as through stable arrangements) in the context of which activity it processes personal data.
[Matter in dispute]
A request for a preliminary ruling was made in the proceedings between Weltimmo s. r. o. (‘Weltimmo’), a company established (registered) in Slovakia, and the Nemzeti Adatvédelmi és Információszabadság Hatóság (‘Hungarian data protection authority’) concerning a fine imposed by the latter for infringement of Act CXII of 2011 on the right to self-determination as regards information and freedom of information (‘Act on information’), which transposed Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31; ‘Directive’) into Hungarian law.
The CJEU decided the Weltimmo case through the lens of the Directive, in particular its preamble and Article 4(1)(a) of the Directive.
According to Article 4(1)(a) of the Directive (and in line with recital 18 in the preamble to the Directive) each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State.
Recital 19 in the preamble of the Directive states that establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements; whereas the legal form of such an establishment, whether simply branch or a subsidiary with a legal personality, is not the determining factor (cf. judgment in Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 48). Moreover, that recital affirms that, when a single controller is established on the territory of several Member States, it must ensure, in order to avoid any circumvention of national rules, that each of the establishments fulfills the obligations imposed by the national law applicable to its activities.
[Rationale for the decision]
The Weltimmo judgment of October 1, 2015 is particularly true for undertakings offering services exclusively over the Internet, due to the factual premises determining application of laws of the Member State other than the one of registration. The CJEU underlined that the application of foreign national data protection laws was warranted, first, by the fact that the activity of the controller, in the context of which data processing takes place, consists in the running of property dealing websites concerning properties situated on the territory of another Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and secondly that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.
Lastly, permit me to summarize the factual background of the Weltimmo case:
Weltimmo, a company registered in Slovakia, ran a property dealing website concerning Hungarian properties in the context of which it processed the personal data of its advertisers. Since advertisements were free of charge only for one month and thereafter would demand a fee, many advertisers sent a request by e-mail for the deletion of both their advertisements and their personal data as from that period. Weltimmo did not delete those data and issued invoices demanding payment. As the amounts charged were not paid, Weltimmo forwarded the personal data of the advertisers concerned to debt collection agencies.
The interested advertisers lodged complaints with the Hungarian data protection authority. That data protection decided that Weltimmo had infringed the Act on information and imposed on that company a fine of approximately EUR 32 000.
What seems to be of significance, the Hungarian data protection authority declared that it was competent under the Act on information, having informally learned from its Slovak counterpart that Weltimmo: (i) did not carry out any activity at the place where it has its registered office, in Slovakia; (ii) moved, on several occasions, that registered office from one state to another; (iii) developed two property dealing websites, written exclusively in Hungarian; (iv) opened a bank account in Hungary, which was intended for the recovery of its debts, and had a letter box in that Member State for its everyday business affairs, and (v) had its representative in Hungary that tried to negotiate the settlement of the unpaid debts with the advertisers.
Weltimmo, dissatisfied with the ruling of the Budapest administrative and labor court, lodged an appeal, and the referring court decided to stay the proceedings and ask the CJEU for a preliminary ruling concerning a number of questions.