Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...
June 30 — A recent recommended opinion by the European Court of Justice's advocate general concerning which European Union member state data protection authority should have jurisdiction over a privacy complaint is causing concern among some attorneys interviewed by Bloomberg BNA.
In the June 25 opinion, Advocate General Pedro Cruz Villalón recommended that the ECJ, the EU's top court, should rule that if a data controller is exclusively “established” in one EU member state, then it should only have to deal with the data protection law and regulators in the country which it is established (Weltimmo s.r.o. v. Nat'l Auth. for Data Prot. and Freedom of Info., E.C.J., No. C-230/14, advocate general recommended opinion 6/25/15).
Villalón said that although other national DPAs should be entitled to monitor, intervene in and investigate a company's operations within their national territory, only the DPA in the country where the company has established its operations should have jurisdiction to declare operations unlawful and issue sanctions.
But the recommended opinion used a very broad definition of what would establish a company in a member state, leaving attorneys split over whether it helps clarify the legal situation for international businesses in Europe or complicates the issue for multinationals doing business in the EU.
If the ECJ adopts the advocate general's recommendation—something which it isn't legally obligated to do but often does—the ruling will have far-reaching consequences for current negotiations over the proposed EU-wide data protection regulation to replace the 20-year-old EU Data Protection Directive (95/46/EC), attorneys told Bloomberg BNA.
Although Villalón's opinion isn't binding, practitioners agreed it holds great relevance for ongoing trilogue negotiations between the European Commission, European Parliament and Council of Ministers on the final form of the proposed data protection regulation, particularly provisions regarding DPA jurisdiction.
Carlo Piltz, an attorney at JBB Rechtsanwälte in Berlin, told Bloomberg BNA June 30 that how the ECJ interprets the Data Protection Directive will particularly influence negotiations over the planned EU-wide one-stop shop regulation, which ties in to issues raised in the present litigation—namely, how national DPAs should work together, establishing the parameters and conditions of cooperation, as well as determining jurisdiction.
The concept of a one-stop-shop for companies dealing with DPAs was a central component of the regulation when released by the European Commission, the EU's administrative arm, in 2012. Under the original plan, the DPA where a company had its headquarters in the EU would act as lead regulator. But since then, disputes about the ability of DPAs from other member states to handle complaints from data subjects in their countries have arisen.
Piltz said the case in question lays out the same problems the one-stop shop could face.
“Negotiators will get to see in real life what the EU directive now says about this situation, where different DPAs are involved but there is one main DPA,” Piltz said. “The negotiators could then say, ‘Well, we also wanted to foresee things like the current directive’ or ‘If that's how the ECJ sees it, we should amend the regulation because that's not the result we want,'” he said.
The advocate general's opinion was sparked by a dispute between Slovakia-based data controller and operator of an online retail marketplace, Weltimmo s.r.o., and the Hungarian data protection authority, the National Authority for Data Protection and Freedom of Information (NAIH).
Weltimmo operated sites targeted at the Hungarian market, which were alleged to have misled customers about its offers and to have transferred customer data to third parties without notice or consent, the NAIH said in a 2012 statement. NAIH said it received several complaints concerning Weltimmo's non-compliance with Hungarian data protection law.
In a 2012 ruling (NAIH-510-6/2012/H), NAIH imposed a maximum fine for unauthorized data processing of 10 million Hungarian forints ($35,430).
Although Weltimmo had Hungarian customers, it challenged in court NAIH's jurisdiction to impose a fine because the company is based in Slovakia. The Hungarian court asked the ECJ for a ruling on the issue.
The recommended opinion “is really highly relevant for companies like Facebook who say they have the problem of having to comply with 28 different data protection laws in the EU,” Piltz said.
Chief executive officers want to know who might fine them if something goes wrong in their handling of data, he said, and the opinion makes that clear, he said.
“I would close nearly all of my establishments and just open one in one European member state where I wanted that national data protection law to be applicable,” he said.
“So it's in a way good for companies because it's a more secure way for them to plan their business base—it's a source of security for businesses,” Piltz said.
The recommended opinion used a broad definition for what establishing a company's operations means and that has raised questions among practitioners about how difficult it may be for the competent DPA is determined.
“In a nutshell, you have two interpretations of establishment: Either you take a strict interpretation of the concept and say, that you need to have a legal entity, like a subsidiary or affiliate to have an establishment,” Cedric Burton, of counsel at Wilson Sonsini Goodrich & Rosati, Brussels, told Bloomberg BNA June 30.
“Or you take a flexible interpretation of the law and say, whatever the form, what counts is having some stable arrangement and a real and effective activity in a member state,” he said.
In this case, the advocate general opted for the latter “flexible” approach which the NAIH told Bloomberg BNA June 30 that it interprets to mean it has proper jurisdiction in the case.
“Weltimmo maintained a website under an .hu domain, with Hungarian real estate advertisements,” Daniel Eszteri, an NAIH legal officer, said. “The website's language was Hungarian, and the managing director of the Slovakian company was also a Hungarian person with permanent residence in Hungary, The company did not make any commercial activity in Slovakia, only the postal address and seat was registered there.”
To contact the reporter on this story: Jabeen Bhatti in Berlin at firstname.lastname@example.org.
To contact the editor responsible for this story: Donald G. Aplin at email@example.com
The advocate general's recommended opinion is available, in German, at http://goo.gl/dhdDE5.
All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to firstname.lastname@example.org.
Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)
Notify me when updates are available (No standing order will be created).
This Bloomberg BNA report is available on standing order, which ensures you will all receive the latest edition. This report is updated annually and we will send you the latest edition once it has been published. By signing up for standing order you will never have to worry about the timeliness of the information you need. And, you may discontinue standing orders at any time by contacting us at 1.800.372.1033, option 5, or by sending us an email to email@example.com.
Put me on standing order
Notify me when new releases are available (no standing order will be created)