Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV.
Date: 2019-07-29
49


Under the third paragraph of Article 288 TFEU, the Member States are required, when transposing a directive, to ensure that it is fully effective, but they retain a broad discretion as to the choice of ways and means of ensuring that it is implemented. That freedom of choice does not affect the obligation imposed on all Member States to which the directive is addressed to adopt all the measures necessary to ensure that the directive concerned is fully effective in accordance with the objective which it seeks to attain (judgments of 6 October 2010, Base and Others, C‑389/08, EU:C:2010:584, paragraphs 24 and 25, and of 22 February 2018, Porras Guisado, C‑103/16, EU:C:2018:99, paragraph 57).
50


In this regard, it must be noted that one of the underlying objectives of Directive 95/46 is to ensure effective and complete protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 53, and of 27 September 2017, Puškár, C‑73/16, EU:C:2017:725, paragraph 38). Recital 10 of Directive 95/46 adds that the approximation of the national laws applicable in this area must not result in any lessening of the protection which they afford but must, on the contrary, seek to ensure a high level of protection in the European Union (judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 95, of 16 December 2008, Huber, C‑524/06, EU:C:2008:724, paragraph 50, and of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 28).
54


Directive 95/46 does indeed amount to a harmonisation of national legislation on the protection of personal data that is generally complete (see, to that effect, judgments of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 29, and of 7 November 2013, IPI, C‑473/12, EU:C:2013:715, paragraph 31).
55


The Court has thus held that Article 7 of that directive sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful and that Member States cannot add new principles relating to the lawfulness of the processing of personal data to that article or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in that article (judgments of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraphs 30 and 32, and of 19 October 2016, Breyer, C‑582/14, EU:C:2016:779, paragraph 57).
56


The Court has, however, also held that Directive 95/46 lays down rules that are relatively general since it has to be applied to a large number of very different situations. Those rules have a degree of flexibility and, in many instances, leave to the Member States the task of deciding the details or choosing between options, meaning that, in many respects, Member States have a margin of discretion in implementing that directive (see, to that effect, judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraphs 83, 84 and 97, and of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 35).
57


This is also the case for Articles 22 to 24 of Directive 95/46, which, as the Advocate General noted in point 42 of his Opinion, are worded in general terms and do not amount to an exhaustive harmonisation of the national provisions stipulating the judicial remedies that can be brought against a person allegedly responsible for an infringement of the laws protecting personal data (see, by analogy, judgment of 26 October 2017, I, C‑195/16, EU:C:2017:815, paragraphs 57 and 58).
58


In particular, although Article 22 of that directive requires Member States to provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the personal data processing in question, that directive does not, however, contain any provisions specifically governing the conditions under which that remedy may be exercised (see, to that effect, judgment of 27 September 2017, Puškár, C‑73/16, EU:C:2017:725, paragraphs 54 and 55).
59


In addition, Article 24 of Directive 95/46 provides that Member States are to adopt ‘suitable measures’ to ensure the full implementation of the provisions of that directive, without defining such measures. It seems that a provision making it possible for a consumer-protection association to commence legal proceedings against a person who is allegedly responsible for an infringement of the laws protecting personal data may constitute a suitable measure, within the meaning of that provision, that contributes, as observed in paragraph 51 above, to the realisation of the objectives of that directive, in accordance with the Court’s case-law (see, to that effect, judgment of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 97).
65


In this regard, it should be noted that, in accordance with the aim pursued by Directive 95/46, namely to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data, Article 2(d) of that directive defines the concept of ‘controller’ broadly as the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data (see, to that effect, judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraphs 26 and 27).
66


As the Court has held previously, the objective of that provision is to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects (judgments of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 34, and of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 28).
67


Furthermore, since, as Article 2(d) of Directive 95/46 expressly provides, the concept of ‘controller’ relates to the entity which ‘alone or jointly with others’ determines the purposes and means of the processing of personal data, that concept does not necessarily refer to a single entity and may concern several actors taking part in that processing, with each of them then being subject to the applicable data-protection provisions (see, to that effect, judgments of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 29, and of 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, paragraph 65).
68


The Court has also held that a natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller within the meaning of Article 2(d) of Directive 95/46 (judgment of 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, paragraph 68).
69


Furthermore, the joint responsibility of several actors for the same processing, under that provision, does not require each of them to have access to the personal data concerned (see, to that effect, judgments of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 38, and of 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, paragraph 69).
70


That said, since the objective of Article 2(d) of Directive 95/46 is to ensure, through a broad definition of the concept of ‘controller’, the effective and comprehensive protection of the persons concerned, the existence of joint liability does not necessarily imply equal responsibility of the various operators engaged in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, with the result that the level of liability of each of them must be assessed with regard to all the relevant circumstances of the particular case (see, to that effect, judgment of 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, paragraph 66).
83


Moreover, it must be emphasised that a website, such as that of Fashion ID, is visited both by those who are members of the social network Facebook, and who therefore have an account on that social network, and by those who do not have one. In that latter case, the responsibility of the operator of a website, such as Fashion ID, for the processing of the personal data of those persons appears to be even greater, as the mere consultation of such a website featuring the Facebook ‘Like’ button appears to trigger the processing of their personal data by Facebook Ireland (see, to that effect. judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388, paragraph 41).
93


In this regard, it should be noted at the outset that, according to the provisions of Chapter II of Directive 95/46, headed ‘General rules on the lawfulness of the processing of personal data’, subject to the derogations permitted under Article 13 of that directive, all processing of personal data must comply, inter alia, with one of the criteria for making data processing legitimate listed in Article 7 of that directive (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 71, and of 1 October 2015, Bara and Others, C‑201/14, EU:C:2015:638, paragraph 30).
95


Article 7(f) of that directive thus lays down three cumulative conditions for the processing of personal data to be lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, the condition that the fundamental rights and freedoms of the data subject whose data require protection do not take precedence (judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 28).
104


In that regard, it follows from the wording of that provision that the controller or his representative must provide, as a minimum, the information referred to in that provision to the subject whose data are being collected. It thus appears that that information must be given by the controller immediately, that is to say, when the data are collected (see, to that effect, judgments of 7 May 2009, Rijkeboer, C‑553/07, EU:C:2009:293, paragraph 68, and of 7 November 2013, IPI, C‑473/12, EU:C:2013:715, paragraph 23).