24

In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling: ‘(1) Is Article 2(d) of Directive [95/46] to be interpreted as definitively and exhaustively defining the liability and responsibility for data protection infringements, or does scope remain, under the “suitable measures” pursuant to Article 24 of Directive [95/46] and the “effective powers of intervention” pursuant to the second indent of Article 28(3) of Directive [95/46], in multi-tiered information provider relationships, for responsibility of an entity that does not control the data processing within the meaning of Article 2(d) of Directive [95/46] when it chooses the operator of its information offering? (2) Does it follow a contrario from the obligation of Member States under Article 17(2) of Directive [95/46] to provide, where data processing is carried out on the controller’s behalf, that the controller must “choose a processor providing sufficient guarantees in respect of the technical security measures and organisational measures governing the processing to be carried out”, that, where there are other user relationships not linked to data processing on the controller’s behalf within the meaning of Article 2(e) of Directive [95/46], there is no obligation to make a careful selection and no such obligation can be based on national law? (3) In cases in which a parent company based outside the European Union has legally independent establishments (subsidiaries) in various Member States, is the supervisory authority of a Member State (in this case, Germany) entitled under Article 4 and Article 28(6) of Directive [95/46] to exercise the powers conferred under Article 28(3) of Directive [95/46] against the establishment located in its territory even when this establishment is responsible solely for promoting the sale of advertising and other marketing measures aimed at the inhabitants of that Member State, whereas the independent establishment (subsidiary) located in another Member State (in this case, Ireland) is exclusively responsible within the group’s internal division of tasks for collecting and processing personal data throughout the entire territory of the European Union and hence in the other Member State as well (in this case, Germany), if the decision on the data processing is in fact taken by the parent company? (4) Are Article 4(1)(a) and Article 28(3) of Directive [95/46] to be interpreted as meaning that, in cases in which the controller has an establishment in the territory of one Member State (in this case, Ireland) and there is another, legally independent establishment in the territory of another Member State (in this case, Germany), whose responsibilities include the sale of advertising space and whose activity is aimed at the inhabitants of that State, the competent supervisory authority in this other Member State (in this case, Germany) may direct measures and orders implementing data protection legislation also against the other establishment (in this case, in Germany) not responsible for data processing under the group’s internal division of tasks and responsibilities, or are measures and orders only possible by the supervisory body of the Member State (in this case, Ireland) in whose territory the entity with internal responsibility within the group has its registered office? (5) Are Article 4(1)(a) and Article 28(3) and (6) of Directive [95/46] to be interpreted as meaning that, in cases in which the supervisory authority in one Member State (in this case, Germany) takes action against a person or entity in its territory pursuant to Article 28(3) of Directive [95/46] on the grounds of failure carefully to select a third party involved in the data processing process (in this case, Facebook), because that third party infringes data protection legislation, the active supervisory authority (in this case, Germany) is bound by the appraisal made under data protection legislation by the supervisory authority of the Member State in which the third party responsible for the data processing has its establishment (in this case, Ireland) meaning that it may not arrive at a different legal appraisal, or may the active supervisory authority (in this case, Germany) conduct its own examination of the lawfulness of the data processing by the third party established in another Member State (in this case, Ireland) as a preliminary question prior to its own action? (6) If the possibility of conducting an independent examination is available to the active supervisory authority (in this case, Germany), is the second sentence of Article 28(6) of Directive [95/46] to be interpreted as meaning that this supervisory authority may exercise the effective powers of intervention conferred on it under Article 28(3) of Directive [95/46] against a person or entity established in its territory on the grounds of their joint responsibility for data protection infringements by a third party established in another Member State only if and not until it has first requested the supervisory authority in this other Member State (in this case, Ireland) to exercise its powers?’