Plans for a single market have been delivered yet another blow, this time as a result of an ECJ preliminary ruling against a relatively unknown Slovakian company. The court ruled in Weltimmo SRO v. Nemzeti Adatvedelmi es Informacioszabadsag Hatosag, that national data protection authorities (DPAs) may take action against businesses that target residents in their Member State, even if the businesses are not registered in that state.
The ruling is significant for the 'one stop-shop' provisions currently being negotiated as part of the General Data Protection Regulation ('GDPR'). In an earlier blog, we explained that the European Council endorsed the 'one-stop-shop' approach, so that in the future, organisations will only need to deal with the DPA having jurisdiction over the location of its EU headquarters, or EU location with delegated data protection responsibility. The decision in Weltimmo says otherwise: an organisation will be subject to the authority of the DPA if it has an 'establishment' within the jurisdiction of the DPA. With the GDPR expected to be finalised later this year, it will be interesting to see how this ruling will be reconciled with the GDPR.
Companies with a pan-European business should sit up and take notice. The ECJ's stance is that companies who carry out 'real and effective activities' in a country, even where those activities are minimal and their registered office is located elsewhere, can be subject to the regulation of the national DPA in that country.
In the current case, the ECJ took into account the fact that Weltimmo (whose registered office is in Slovakia) ran a website written in Hungarian, dealt with properties in Hungary and had a representative based in Hungary, and determined that it was unquestionably pursuing a 'real and effective' activity in Hungary.
The ramifications of this ruling on companies operating across multiple EU jurisdictions could be huge, as they could be subject to multiple DPAs and could face hefty fines for any non-compliance.
As Weltimmo wakes up to its new-found fame ... organisations should be alert to the implications for their business.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.