Brussels, 01/10/2015 (Agence Europe) - Data protection legislation of a member state may be applied to a foreign company which, through “stable arrangements”, exercises a “real and effective activity” in that state. If these conditions are not met, possible failures by the company must be dealt with under the national legislation of the state in which the company is headquartered.
That was the ruling delivered on Thursday 1 October (case C-230/14) by the Court of Justice of the EU, clarifying which national data protection laws should apply to companies operating across borders, under the terms of the data protection directive (95/46/EC). The case at issue involved Weltimmo, a company registered in Slovakia, which runs a property dealing website for Hungarian properties. After the company failed to delete the advertisements and personal data of numerous advertisers despite their requests, the Hungarian data protection authority imposed a fine on Weltimmo for infringing the Hungarian law transposing the directive. Weltimmo appealed against this decision and the Hungarian supreme court asked the Court of Justice whether, in the present case, the directive enabled the Hungarian supervisory authority to apply the Hungarian law adopted on the basis of the directive and to impose the fine provided for by that law.
The Court ruled that it could if it is confirmed that the company exercises a “real and effective activity” in Hungary and has an “establishment”, within the meaning of the directive - that is, has stable arrangements (having a representative meets this criterion, the Court said). This would seem to be the case with Weltimmo which is involved in the sale of Hungarian real estate and which has a representative who acts as a point of contact between the company and advertisers, a bank account in Hungary, intended for the recovery of its debts, and uses a letter box in Hungary.
Were these conditions not to be met, the law applicable would be that of another member state - in this case, that of Slovakia, where Weltimmo has its headquarters - and the supervisory authority of the country where the infringement was committed would not be able to exercise the powers to impose penalties under its own national law, its powers being limited to its national territory. Under such circumstances, the supervisory authority would have to request the supervisory authority of the other member state concerned to establish an infringement of the law of that state and to impose the penalties which may be provided for by that law, the Court stated. (Original version in French by Francesco Gariazzo)