Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság.
Date: 2015-10-01
25. In the light of the objective pursued by Directive 95/46, consisting in ensuring effective and complete protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data, the words ‘in the context of the activities of an establishment’ cannot be interpreted restrictively (see, to that effect, judgment in Google Spain and Google , C‑131/12, EU:C:2014:317, paragraph 53).
27. The EU legislature thus prescribed a particularly broad territorial scope of Directive 95/46, which it registered in Article 4 thereof (see, to that effect, judgment in Google Spain and Google , C‑131/12, EU:C:2014:317, paragraph 54).
28. With regard, in the first place, to the concept of ‘establishment’, it should be noted that recital 19 in the preamble to Directive 95/46 states that establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements and that the legal form of such an establishment, whether simply a branch or a subsidiary with a legal personality, is not the determining factor (judgment in Google Spain and Google , C‑131/12, EU:C:2014:317, paragraph 48). Moreover, that recital states that, when a single controller is established on the territory of several Member States, he must ensure, in order to avoid any circumvention of national rules, that each of the establishments fulfils the obligations imposed by the national law applicable to its activities.
29. As the Advocate General observed, in essence, in points 28 and 32 to 34 of his Opinion, this results in a flexible definition of the concept of ‘establishment’, which departs from a formalistic approach whereby undertakings are established solely in the place where they are registered. Accordingly, in order to establish whether a company, the data controller, has an establishment, within the meaning of Directive 95/46, in a Member State other than the Member State or third country where it is registered, both the degree of stability of the arrangements and the effective exercise of activities in that other Member State must be interpreted in the light of the specific nature of the economic activities and the provision of services concerned. This is particularly true for undertakings offering services exclusively over the Internet.
31. In addition, in order to attain that objective, it should be considered that the concept of ‘establishment’, within the meaning of Directive 95/46, extends to any real and effective activity — even a minimal one — exercised through stable arrangements.
35. The Court has already held that Article 4(1)(a) of Directive 95/46 requires the processing of personal data in question to be carried out not ‘by’ the establishment concerned itself, but only ‘in the context of the activities’ of the establishment (judgment in Google Spain and Google , C‑131/12, EU:C:2014:317, paragraph 52).
37. In this respect, it should be observed that, as regards in particular the Internet, the Court has already had occasion to state that the operation of loading personal data on an Internet page must be considered to be ‘processing’ within the meaning of Article 2(b) of Directive 95/46 (judgments in Lindqvist , C‑101/01, EU:C:2003:596, paragraph 25, and Google Spain and Google , C‑131/12, EU:C:2014:317, paragraph 26).
51. It is apparent from Article 28(1) and (3) of Directive 95/46 that each supervisory authority is to exercise all of the powers conferred on it on the territory of its own Member State in order to ensure, on that territory, compliance with data protection rules.
56. As the Advocate General observed in point 50 of his Opinion, it follows from the requirements derived from the territorial sovereignty of the Member State concerned, the principle of legality and the concept of the rule of law that the exercise of the power to impose penalties cannot take place, as a matter of principle, outside the legal limits within which an administrative authority is authorised to act subject to the law of its own Member State.