The Court of Justice of the European Union (CJEU) ruled in a judgment (Case C‑492/23) on Tuesday 2 December that the operator of an e-commerce website is in fact liable for the processing of personal data contained in advertisements published on its platform, even if it is not itself the source of the data.
The case in question involved a Romanian woman whose image and personal data had been used without her consent in a sexual advertisement placed online by one of the users of the online marketplace publi24.ro, owned by the company Russmedia Digital.
Although the victim won her case at first instance, the Romanian court exonerated the company on appeal, classifying it as a mere host that was not responsible for the content published by its users.
The Romanian Court of Appeal subsequently referred the matter to the CJEU for an interpretation of several provisions of European law, in particular Articles 12 to 15 of Directive 2000/31/EC on the liability of intermediary service providers, as well as the articles of the GDPR relating to the protection of personal data, in order to determine whether the exemption from liability provided for hosts and/or intermediaries was legitimate.
In its judgment of 2 December, the CJEU considers that the platform plays an active role in the processing of data for advertisements (setting conditions, managing advertisements, moderating, altering the formatting, setting the terms of submission, imposing publication rules, etc.) and is therefore subject to all the obligations of the GDPR: transparency, security, respect for sensitive data, consent and prior verification.
According to the CJEU, the exemption for web hosts applies only to purely technical and passive activities. The site in question does not fall into this category.
With this judgment, the CJEU limits the notion that a platform can host user ads in a neutral manner without being responsible for their content and the data processed, even when these ads are published by a third party.
See the judgment: https://aeur.eu/f/jsx (Original version in French by Isalia Stieffatre)