Judgment;Abstract — ECLI:EU:C:2025:935
Date: 2025-12-02
Language of the case: Romanian
Court formation: Grand Chamber
Procedure: Reference for a preliminary ruling
Origin: Romania

Summary C-492/23 – 1 
Case C-492/23 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
3 August 2023 
Referring court: 
Curtea de Apel Cluj (Romania) 
Date of the decision to refer: 
15 June 2023 
Applicant at first instance: 
X 
Defendants at first instance: 
Russmedia Digital SRL 
Inform Media Press SRL 
  
Subject matter of the main proceedings 
Appeal following the annulment of the civil judgment handed down on appeal by 
the Tribunalul Specializat Cluj (Specialised Court, Cluj, Romania) in the case in 
which the parties are, on the one hand, Russmedia Digital SRL and Inform Media 
Press SRL, the appellants (defendants at first instance), and, on the other hand, X, 
the respondent (applicant at first instance); the appeal concerns a claim for 
compensation in respect of non-material damage allegedly caused by the 
publication on various websites of advertisements containing personal data. 
Subject matter and legal basis of the request 
Pursuant to Article 267(3) TFEU, the interpretation is sought of Articles 12 to 15 
of Directive 2000/31/EC and of Article 2(4); Article 4(7) and (11); Article 5(1)(b) 
and (f); Article 6(1)(a) and Articles 7, 24 and 25 of Regulation (EU) 2016/679. 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-492/23 
 
2  
Questions referred for a preliminary ruling 
1. Do Articles 12 to 14 of Directive 2000/31/EC also apply to a storage and 
hosting information service provider that makes available to users a website on 
which free or paid advertisements may be published, which claims that its role in 
publishing users’ advertisements is purely technical (making the platform 
available), but which, through the general terms and conditions of use of the 
website, indicates that it does not claim ownership over the content that is 
provided, published, uploaded or transmitted, yet retains the right to use the 
content, including by means of copying it, distributing it, transmitting it, 
publishing it, reproducing it, modifying it, translating it, transferring it to partners 
and removing it at any time, without the need for any reason for doing so? 
2. Must Article 2(4), Article 4(7) and (11), Article 5(1)(f), Article 6(1)(a), 
Articles 7, 24 and 25 of Regulation (EU) 2016/679 of the European Parliament 
and of the Council of 27 April 2016 and Article 15 of Directive 2000/31/EC be 
interpreted as requiring such a storage and hosting information service provider, 
which is the personal data controller, to verify before publishing an advertisement 
whether the person publishing the advertisement and the owner of the personal 
data referred to in the advertisement are the same person? 
3. Must Article 2(4), Article 4(7) and (11), Article 5(1)(f), Article 6(1)(a), 
Articles 7, 24 and 25 of Regulation (EU) 2016/679 of the European Parliament 
and of the Council of 27 April 2016 and Article 15 of Directive 2000/31/EC be 
interpreted as requiring such a storage and hosting information service provider, 
which is the personal data controller, to verify in advance the content of 
advertisements published by users, in order to exclude advertisements which are 
potentially unlawful in nature or likely to infringe a person’s private and family 
life? 
4. Must Article 5(1)(b) and (f), Articles 24 and 25 of Regulation (EU) 
2016/679 of the European Parliament and of the Council of 27 April 2016 and 
Article 15 of Directive 2000/31/EC be interpreted as requiring such a storage and 
hosting information service provider, which is the personal data controller, to 
apply safeguards which prevent or limit the reproduction and redistribution of the 
content of the advertisements published through it? 
Provisions of European Union law and case-law relied on 
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 
2000 on certain legal aspects of information society services, in particular 
electronic commerce, in the Internal Market (‘Directive on electronic commerce’), 
Articles 12 to 15 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
RUSSMEDIA DIGITAL AND INFORM MEDIA PRESS 
 
3 
95/46/EC (General Data Protection Regulation; ‘the GDPR’), Article 2(4), 
Article 4(7) and (11), Article 5(1)(b) and (f), Article 6(1)(a) and Articles 7, 24 and 
25. 
Joined Cases C-236/08 to C-238/08, Google France and Google; Case C-l8/18, 
Glawischnig-Piesczek; Case C-460/20, Google (Dereferencing of allegedly 
inaccurate content); Case C-401/19, Poland v Parliament and Council; Case 
C-291/13, Papasavvas; Case C-521/17, SNB-REACT; Case C-484/14, McFadden; 
Case C-324/09, L’Oréal and Others. 
Provisions of national law relied on 
Legea nr. 365 din 7 iunie 2002 privind comerțul electronic (Law No 365 of 7 June 
2002 on electronic commerce; ‘Law No 365/2002’), by which Directive 
2000/31/EC, Articles 11 to 14, which forms part of Chapter IV on the liability of 
service providers, was transposed into national law. Article 11 lays down the 
conditions for civil, criminal and administrative liability, respectively, for the 
information provided and for the information transmitted. Article 12 specifically 
regulates intermediation by mere transmission, by providing that the provider of 
that service is not liable for the information transmitted where certain conditions 
relating to its lack of involvement in the initiation, reception and content of the 
transmission are met. Article 13 lays down the conditions under which the service 
provider is not liable for the automatic, intermediate and temporary storage of the 
information transmitted, and Article 14, entitled ‘Hosting’, provides in 
paragraph 1 as follows: ‘Where an information society service is provided that 
consists of the storage of information provided by a recipient of the service, 
Member States shall ensure that the service provider is not liable for the 
information stored at the request of a recipient of the service, on condition that: 
(a) the provider does not have actual knowledge of illegal activity or information 
and, as regards claims for damages, is not aware of facts or circumstances from 
which the illegal activity or information is apparent; or (b) the provider, upon 
obtaining such knowledge or awareness, acts expeditiously to remove or to 
disable access to the information.’ 
Normele metodologice pentru aplicarea Legii nr. 365/2002 privind comerțul 
electronic (Implementing Rules for the application of Law No 365/2002 on 
electronic commerce) approved by Hotărârea Guvernului nr. 1308/2002 
(Government Decision No 1308/2002) (‘the Implementing Rules’), Article 11(1), 
according to which ‘Information Society service providers which offer the services 
referred to in Articles 12 to 15 of the Law are not required to monitor the 
information which they transmit or store, nor are they required actively to seek 
data on activities or information having the appearance of unlawful activity in the 
information society services sector which they supply’. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-492/23 
 
4  
Succinct presentation of the facts and procedure in the main proceedings 
1 X, as the applicant, brought an action before the Judecătoria Cluj-Napoca (Court 
of First Instance, Cluj-Napoca) against the company Russmedia Digital SRL as 
owner of the www.publi24.ro website. She claimed that, on 1 August 2018, an 
advertisement appeared on the website published by an unidentified third party, 
without her consent, that contained denigrating and offensive content. 
Specifically, according to the advertisement, the applicant offered sexual services, 
and photographs of the applicant also appeared in the advertisement without her 
consent, along with her telephone number. The advertisement published without 
the applicant’s consent was quickly reproduced on other web pages containing 
advertising content and is currently also published on numerous websites, 
indicating the original source. 
2 The Court of First Instance, Cluj-Napoca upheld that action and ordered 
Russmedia Digital SRL to pay the sum of EUR 7 000, corresponding to the non-
material damage caused by the infringement of the applicant’s right of personal 
portrayal, right to honour and reputation and right to privacy, as well as the 
improper processing of her personal data. 
3 The Court of First Instance found that that publication constituted a breach of the 
obligations imposed on the defendant by the GDPR and that the defendant’s 
passivity had seriously undermined the applicant’s private life, as that act was 
unlawful within the meaning of Article 253 of the Codul civil (Civil Code). 
4 The aspects concerning Inform Media Press SRL are irrelevant for the purposes of 
the questions referred for a preliminary ruling. 
5 Russmedia Digital SRL brought an appeal against that judgment before the 
Specialised Court, Cluj. The latter varied the judgment under appeal and 
dismissed as unfounded the action brought by X against Russmedia Digital SRL. 
At the same time, X was ordered to pay Russmedia Digital SRL, the appellant, the 
sum of RON 4 550 corresponding to the costs of the appeal. 
6 The Specialised Court, Cluj considered that the advertisement did not contain 
information originating from the appellant company, since the company had 
provided only an advertisement hosting service, without being actively involved 
in its content. In addition, as soon as it discovered that the advertisement was 
capable of infringing the respondent’s rights, the appellant deactivated it. 
7 Consequently, that court held that Law No 365/2002, more specifically 
Article 14(1)(b), which exempted the appellant from liability for non-material 
damage caused by the content of advertisements published by users on its website, 
www.publi24.ro, was applicable in the present case. Similarly, it took the view 
that Article 11(1) of the Implementing Rules was also relevant, such that the 
appellant was not required to verify the information which it transmitted. 
RUSSMEDIA DIGITAL AND INFORM MEDIA PRESS 
 
5 
8 X brought an appeal against that judgment before the Curtea de Apel Cluj (Court 
of Appeal, Cluj), requesting that the appeal be upheld, that the judgment of the 
Specialised Court, Cluj be annulled, that the appeal brought by Russmedia Digital 
SRL be dismissed as unfounded and that the judgment of the Court of First 
Instance, Cluj-Napoca be upheld as being legitimate and well founded. 
9 X argued that the judgment of the appeal court is unlawful in that it misinterpreted 
and misapplied the provisions of Law No 365/2002 and that the reason for 
annulment provided for in Article 488(1)(8) of the Codul de procedură civilă 
(Code of Civil Procedure) was relevant. She submits that Law No 365/2002 is not 
a special law in relation to the GDPR, which is directly applicable, and that it does 
not create any liability which derogates from, and takes priority over, the GDPR. 
In that sense, the Specialised Court, Cluj should also have analysed Russmedia 
Digital SRL’s liability from the point of view of the GDPR. 
10 In X’s view, Russmedia Digital SRL did not merely offer a storage or hosting 
service and Law No 365/2002 is not applicable to it, but also played a 
management role, intervening at the content level for the purpose of good 
information management. Its role, which is to store certain applications on the 
server, in a certain order, with a certain format or design, available on a certain 
interface entirely managed by Russmedia Digital SRL, makes that company an 
information content provider because of its active involvement in respect of the 
data and information that are stored. The company is also the personal data 
processor and breached the provisions of the GDPR by means of processing which 
does not comply with that regulation. X’s personal data were used without her 
consent, and it is possible, on the aforementioned website, for any individual to 
publish any text with any content, including images of other persons, without 
ensuring the security of those personal data processed through the website, which 
makes it impossible to permanently delete such data from the online space. The 
deletion of the advertisement does not exempt the company from liability because, 
at the time of removal, the message had already been taken up by other websites 
and disseminated on a large scale, and the damage had already occurred and 
cannot be repaired in full. 
11 Russmedia Digital SRL contended that the extraordinary appeal should be 
dismissed as unfounded and the outcome of the appeal should be confirmed as 
lawful and well-founded, and also claimed payment of the costs of the 
proceedings, arguing that the Specialised Court’s solution is reasoned both in fact 
and in law. In its view, special and derogating rules, such as Law No 365/2002, 
take precedence over a rule of EU law. 
12 The Court of Appeal, Cluj, the referring court, held that the Specialised Court, 
Cluj did not refer to the provisions of the GDPR, even though it was under a 
procedural obligation to analyse them incidentally and they were also expressly 
and insistently invoked by X, in a context in which that court was required to 
analyse the relationship between the national law, Law No 365/2002, and the 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-492/23 
 
6  
GDPR, a legal act with direct and mandatory application in the national legal 
system. 
13 Consequently, the referring court upheld the appeal and set aside the judgment 
under appeal in its entirety, finding there to be grounds for a new judgment on the 
appeal. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
14 The referring court analysed a series of judgments of the Court of Justice in cases 
in which the question of the classification of the type of operator and the services 
provided, from the point of view of the operator’s liability, was raised. 
15 For example, in Joined Cases C-236/08 to C-238/08, the Court held that, in the 
case of an internet referencing service provider, that service provider cannot be 
held liable for the data which it has stored at the request of an advertiser, unless, 
having obtained knowledge of the unlawful nature of those data or of that 
advertiser’s activities, it failed to act expeditiously to remove or to disable access 
to the data concerned. In Case C-18/18, the Court held that a court of a Member 
State may not, first, grant an injunction against a host provider requiring it to 
monitor generally the information which it stores or, second, require that host 
provider actively to seek facts or circumstances underlying the illegal content. In 
Case C-460/20, the Court dealt with the question of the veracity and accuracy of 
information which can be accessed through the use of online search engines. Thus, 
when applying the data subject’s ‘right to be forgotten’, the operator of a search 
engine will be required to remove the information contained in the indexed 
content where the data subject requesting the dereferencing establishes the 
manifest inaccuracy of the information. In Case C-401/19, the Court found, as 
regards online content-sharing platforms, that, in order to avoid liability where 
users upload unlawful content to the platforms of online content-sharing service 
providers for which the latter have no authorisation from the rightholders, those 
providers must demonstrate that they fulfil all the other conditions for exemption 
laid down in Article 17(4)(a), (b) and (c) of Directive (EU) 2019/790. The 
application of Article 17 of Directive 2000/31/EC does not entail any general 
monitoring obligation, even though Article 17(8) of Directive (EU) 2019/790 
establishes an additional guarantee for compliance with the right to freedom of 
expression and information of users of online services. Providers of such services 
cannot be required to prevent the uploading and making available to the public of 
content which, if it were found to be unlawful, would require an independent 
assessment of the content in the light of the information provided by the 
rightholders. In Case C-291/13, the Court concluded that the limitations of civil 
liability specified in Articles 12 to 14 of Directive 2000/31/EC do not apply to the 
case of a newspaper publishing company which operates a website on which the 
online version of a newspaper is posted, that company being, moreover, 
remunerated by income generated by commercial advertisements posted on that 
website, since it has knowledge of the information posted and exercises control 
RUSSMEDIA DIGITAL AND INFORM MEDIA PRESS 
 
7 
over that information. In Case C-521/17, the Court ruled that Articles 12 to 14 of 
Directive 2000/31/EC must be interpreted as meaning that the limitations of 
liability for which they provide apply to the provider of an IP address rental and 
registration service allowing the anonymous use of internet domain names, such 
as that at issue in the case in the main proceedings, inasmuch as that service 
comes within the scope of one of the categories of service referred to in those 
articles and meets all the corresponding conditions, in so far as the activity of such 
a service provider is of a merely technical, automatic and passive nature, implying 
that he has neither knowledge of nor control over the information transmitted or 
cached by his customers, and in so far as he does not play an active role in 
allowing those customers to optimise their online sales activity. In Case C-324/09, 
the Court held that Article 14(1) of Directive 2000/31/EC must be interpreted as 
applying to the operator of an online marketplace where that operator has not 
played an active role allowing it to have knowledge or control of the data stored. 
The operator plays such a role when it provides assistance which entails, in 
particular, optimising the presentation of the offers for sale in question or 
promoting them. The operator nonetheless cannot rely on the exemption from 
liability provided for in that provision if it was aware of facts or circumstances on 
the basis of which a diligent economic operator should have realised that the 
offers for sale in question were unlawful and, in the event of it being so aware, 
failed to act expeditiously in accordance with Article 14(1)(b) of Directive 
2000/31/EC. 
16 The Court of Appeal, Cluj, also cites the judgment of the European Court of 
Human Rights in Delfi A.S. v. Estonia, in which the appellant company, which 
operated a commercial news portal, was declared by the national courts to be 
liable for the offensive comments posted by its readers regarding a newspaper 
article about a ferry company. At the request of the ferry company’s lawyers, the 
appellant company removed the offensive comments, but only about six weeks 
after their publication. The ECtHR held that the decision of the national court did 
not breach Article 10 (freedom of expression) of the Convention for the Protection 
of Human Rights and Fundamental Freedoms, since, where third-party user 
comments are in the form of hate speech and direct threats to the physical integrity 
of individuals, the rights and interests of others and of society as a whole may 
entitle Contracting States to impose liability on Internet news portals if they fail to 
take measures to remove clearly unlawful comments without delay. 
17 The analysed case-law of the Court of Justice refers only to offers published on a 
website, the unlawful nature of which results from the analysis of facts and 
circumstances which were expressly communicated to the operator after the 
publication of the advertisement, but does not also analyse the situation identified 
in the present case, the specific nature of which lies in the fact that the content of 
the advertisement published by an unidentified user contained unequivocally 
unlawful content which was deeply harmful to the data subject. That unlawful 
nature was obvious since the alleged services offered by the injured party 
seriously infringe, by their very nature, their right to personal portrayal. Moreover, 
the sexual services allegedly offered under the published advertisement may be 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-492/23 
 
8  
associated with serious offences under the Codul penal (Criminal Code), such as 
procuring (Article 213 of the Criminal Code) and human trafficking (Article 210 
of the Criminal Code). 
18 Under the terms and conditions of use of the online platform operated by 
Russmedia Digital SRL, the latter does not appear to be a mere passive user of the 
data (intermediary service provider), since, although it does not claim an 
ownership right over the content provided, published, uploaded or transmitted, it 
nevertheless retains the right to use the content, including the right to copy, 
distribute, transmit, publish, reproduce, modify, translate, transfer it to partners 
and remove it at any time, without the need for any reason for doing so. 
19 The Court of Appeal, Cluj is ruling on the case as the appellate court and the 
decision will therefore be final.