Landmark ECJ data protection ruling could impact Facebook and Google
|
Version 0 of 1. The European Court of Justice has ruled in favour of the Hungarian data protection authority in its case against Slovakian property site Weltimmo. It’s a landmark ruling that could have big implications for companies such as Facebook and Google, operating across multiple EU countries. The ECJ ruled Thursday that if a company operates a service in the native language of a country, and has representatives in that country, then it can be held accountable by the country’s national data protection agency despite not being headquartered in the country. Ashley Winton, UK head of data protection and privacy at law firm Paul Hastings said: “This landmark ruling from the ECJ has changed the face of data protection for companies operating across multiple EU jurisdictions, particularly those who are consumer facing.” Changes to one-stop-shop The case was brought by the Hungarian data protection authority against property website Weltimmo, which operates a property advertising service in Hungary but is based in Slovakia. The ECJ decided that Weltimmo could be liable for fines imposed by the Hungarian authority for breach of national data protection law. Before the judgment, companies such as Facebook which choose to headquarter their European operations in one country, such as Ireland, were thought to be subject to regulation only within that country. The companies could then operate in any EU member state without having to gain regulatory approval in each country. “This was to the benefit of many companies, some of whom elected to create an establishment in the UK or Ireland, where data protection laws and practices are more liberal and arguably more business friendly,” said Winton. The Google Spain case of 2014 that led to the “right to be forgotten” ruling brought that proposition into question, and the Weltimmo case now puts it on shaky ground. The ruling means that Weltimmo could be liable for the 10m Hungarian forint (£23,650) fine levied by the Hungarian authority over the passing of user information to debt collection agencies, which was found to infringe Hungarian data protection laws. But the implications for the likes of Facebook and Google could be vast. “This [ruling could] dramatically increase compliance costs, particularly where a website is targeted at multiple member states, making the company subject to multiple data protection authorities. With the appetite for enforcement high across a number of member states, the repercussions for non-compliance could be huge,” said Winton. Basis of operations in the country The case revolves around what constitutes a company’s “establishment” within a country. Should a company be found to have operations within a country, such as representatives registered in the country, bank accounts, offices or similar, then fines can be applied by local data protection authorities. If, however, “establishment” cannot be proven, then the local data protection authority cannot impose penalties outside of its own state and must rely on the data protection authority in the company’s base of operations. Several cases have been brought against Facebook over privacy across Europe, including in Belgium and Austria, where the national data protection authorities have argued that Facebook has breached their national laws. The ruling could give those national data protection authorities more power to enforce local rules, and is likely to impact both the Max Schrems case and the Belgian data protection lawsuit against Facebook. New rules governing the one-stop-shop approach to regulation across Europe are currently under development having been proposed by the European Commission and currently within a “trilogue” between the EC, the European parliament and the Council of the European Union discussing each of their amendments to the EC’s proposal. |