WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”)

Data protection authorities powers and cooperation: In the event that the Hungarian DPA should consider that Weltimmo has an establishment not in Hungary, but in another Member State, it may exercise its powers only within its own territory, and it may, irrespective of the applicable law and before even knowing which national law is applicable, thereby investigate the complaint. If it becomes apparent that it is the law of another Member State that applies, that DPA cannot impose penalties outside the territory of its own Member State but shall cooperate with the other DPA instead. (¶¶ 44–58)

With regard, in the first place, to the competence of a supervisory authority to act in such a case, it must be observed that, under Article 28(4) of Directive 95/46, each supervisory authority is to hear claims lodged by any person concerning the protection of his rights and freedoms in regard to the processing of personal data.

Consequently, in a situation such as that at issue in the main proceedings, the Hungarian data protection authority may hear claims lodged by persons, such as the advertisers of properties at issue in the main proceedings, who consider themselves victims of unlawful processing of their personal data in the Member State in which they hold those properties.

In the second place, it is necessary to examine what are the powers of that supervisory authority, in the light of Article 28(1), (3) and (6) of Directive 95/46.

It follows from Article 28(1) of that directive that each supervisory authority established by a Member State is to ensure compliance, within the territory of that Member State, with the provisions adopted by the Member States pursuant to Directive 95/46.

Pursuant to Article 28(3) of Directive 95/46, those supervisory authorities are in particular to be endowed with investigative powers, such as powers to collect all the information necessary for the performance of their supervisory duties, and effective powers of intervention, such as powers of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, or of warning or admonishing the data controller.

In view of the non-exhaustive nature of the powers thus listed and the type of powers of intervention mentioned in that provision, as well as the discretion available to the Member States in transposing Directive 95/46, it should be considered that those powers of intervention may include the power to penalise the data controller by imposing on him, where appropriate, a fine.

The powers granted to the supervisory authorities must be exercised in accordance with the procedural law of the Member State to which they belong.

It is apparent from Article 28(1) and (3) of Directive 95/46 that each supervisory authority is to exercise all of the powers conferred on it on the territory of its own Member State in order to ensure, on that territory, compliance with data protection rules.

That territorial application of the powers of each supervisory authority is confirmed in Article 28(6) of the directive, which states that each supervisory authority is competent, whatever the national law applicable, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with Article 28(3) of that directive. Article 28(6) of the directive also states that each authority may be requested to exercise its powers by an authority of another Member State and that the supervisory authorities are to cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

That provision is necessary in order to ensure the free flow of personal data in the European Union, whilst ensuring compliance with the rules aimed at protecting the privacy of natural persons laid down in Directive 95/46. In the absence of that provision, where the controller of personal data is subject to the law of a Member State, but infringes the right to the protection of the privacy of natural persons in another Member State, in particular by directing his activity at that other Member State without, however, being established there within the meaning of that directive, it would be difficult, or even impossible, for those persons to enforce their right to that protection.

It thus follows from Article 28(6) of Directive 95/46 that the supervisory authority of a Member State, to which a complaint has been submitted, on the basis of Article 28(4) of that directive, by natural persons in relation to the processing of their personal data, may examine that complaint irrespective of the applicable law, and, consequently, even if the law applicable to the processing of the data concerned is that of another Member State.

However, in that case, the powers of that authority do not necessarily include all of the powers conferred on it in accordance with the law of its own Member State.

As the Advocate General observed in point 50 of his Opinion, it follows from the requirements derived from the territorial sovereignty of the Member State concerned, the principle of legality and the concept of the rule of law that the exercise of the power to impose penalties cannot take place, as a matter of principle, outside the legal limits within which an administrative authority is authorised to act subject to the law of its own Member State.

Thus, when a supervisory authority receives a complaint, in accordance with Article 28(4) of Directive 95/46, that authority may exercise its investigative powers irrespective of the applicable law and before even knowing which national law is applicable to the processing in question. However, if it reaches the conclusion that the law of another Member State is applicable, it cannot impose penalties outside the territory of its own Member State. In such a situation, it must, in fulfilment of the duty of cooperation laid down in Article 28(6) of that directive, request the supervisory authority of that other Member State to establish an infringement of that law and to impose penalties if that law permits, based, where necessary, on the information which the authority of the first Member State has transmitted to the authority of that other Member State.

The supervisory authority to which such a complaint has been submitted may, in the context of that cooperation, find it necessary to carry out other investigations, on the instructions of the supervisory authority of the other Member State.