Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH.
Date: 2018-06-05
26


To answer those questions, it must be recalled that, as is apparent from Article 1(1) and recital 10 of Directive 95/46, the directive aims to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraph 27 and the case-law cited).
27


In accordance with that aim, Article 2(d) of the directive defines the concept of ‘controller’ broadly as the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
28


As the Court has previously held, the objective of that provision is to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of the persons concerned (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 34).
29


Furthermore, since, as Article 2(d) of Directive 95/46 expressly provides, the concept of ‘controller’ relates to the entity which ‘alone or jointly with others’ determines the purposes and means of the processing of personal data, that concept does not necessarily refer to a single entity and may concern several actors taking part in that processing, with each of them then being subject to the applicable data protection provisions.
38


While the audience statistics compiled by Facebook are indeed transmitted to the fan page administrator only in anonymised form, it remains the case that the production of those statistics is based on the prior collection, by means of cookies installed by Facebook on the computers or other devices of visitors to that page, and the processing of the personal data of those visitors for such statistical purposes. In any event, Directive 95/46 does not, where several operators are jointly responsible for the same processing, require each of them to have access to the personal data concerned.
41


It must be emphasised, moreover, that fan pages hosted on Facebook can also be visited by persons who are not Facebook users and so do not have a user account on that social network. In that case, the fan page administrator’s responsibility for the processing of the personal data of those persons appears to be even greater, as the mere consultation of the home page by visitors automatically starts the processing of their personal data.
47


On this point, it must be recalled that, in the context of the cooperation between the Court and the national courts provided for in Article 267 TFEU, it is solely for the national court, before which the dispute has been brought and which must assume responsibility for the subsequent judicial decision, to determine in the light of the particular circumstances of the case both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it submits to the Court. Consequently, where the questions submitted concern the interpretation of EU law, the Court is, in principle, bound to give a ruling (judgment of 6 September 2016, Petruhhin, C‑182/15, EU:C:2016:630, paragraph 19 and the case-law cited).
50


To answer those questions, it must be recalled as a preliminary point that, in accordance with Article 28(1) and (3) of Directive 95/46, each supervisory authority is to exercise all the powers conferred on it by national law in the territory of its own Member State, in order to ensure compliance with the data protection rules in that territory (see, to that effect, judgment of 1 October 2015, Weltimmo, C‑230/14, EU:C:2015:639, paragraph 51).
54


As regards, first, the condition that the controller responsible for the processing of personal data must have an establishment in the territory of the Member State of the supervisory authority, it must be recalled that, according to recital 19 of Directive 95/46, establishment in the territory of a Member State implies the effective and real exercise of activity through stable arrangements, and the legal form of such an establishment, whether simply a branch or a subsidiary with a legal personality, is not the determining factor (judgment of 1 October 2015, Weltimmo, C‑230/14, EU:C:2015:639, paragraph 28 and the case-law cited).
56


As regards, second, the condition that the processing of personal data must be carried out ‘in the context of the activities’ of the establishment in question, it must be recalled, to begin with, that in view of the objective pursued by Directive 95/46 of ensuring effective and complete protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, the expression ‘in the context of the activities of an establishment’ cannot be interpreted restrictively (judgment of 1 October 2015, Weltimmo, C‑230/14, EU:C:2015:639, paragraph 25 and the case-law cited).
57


Next, it must be pointed out that Article 4(1)(a) of Directive 95/46 does not require that such processing be carried out ‘by’ the establishment concerned itself, but only that it be carried out ‘in the context of the activities of’ the establishment (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 52).
60


As the Advocate General observes in point 94 of his Opinion, given that a social network such as Facebook generates a substantial part of its income from advertisements posted on the web pages set up and accessed by users, and given that Facebook’s establishment in Germany is intended to ensure the promotion and sale in Germany of advertising space that makes Facebook’s services profitable, the activities of that establishment must be regarded as inextricably linked to the processing of personal data at issue in the main proceedings, for which Facebook Inc. is jointly responsible with Facebook Ireland. Consequently, such treatment must be regarded as being carried out in the context of the activities of an establishment of the controller within the meaning of Article 4(1)(a) of Directive 95/46 (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraphs 55 and 56).
68


As provided for by the second subparagraph of Article 28(1) of that directive, the supervisory authorities whose task it is to supervise the application, in the territory of their own Member States, of the provisions adopted by those States pursuant to the directive are to act with complete independence in exercising the functions entrusted to them. That requirement also follows from EU primary law, in particular Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU (see, to that effect, judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 40).
71


It must be recalled that, as the national supervisory authorities are responsible, in accordance with Article 8(3) of the Charter of Fundamental Rights and Article 28 of Directive 95/46, for monitoring compliance with the EU rules concerning the protection of individuals with regard to the processing of personal data, each of them is therefore vested with the power to check whether the processing of personal data in the territory of its own Member State complies with the requirements laid down by Directive 95/46 (see, to that effect, judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 47).
72


Since Article 28 of Directive 95/46 applies by its very nature to any processing of personal data, even where there is a decision of a supervisory authority of another Member State, a supervisory authority hearing a claim lodged by a person concerning the protection of his rights and freedoms with regard to the processing of personal data relating to him must examine, with complete independence, whether the processing of that data complies with the requirements laid down by that directive (see, to that effect, judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 57).