# WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”) - Type: Case Law - Source: CJEU - Date: 2015-10-01 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0230 - Canonical: https://overview.legal/posts/5956 - Topics: Supervisory Authorities, Supervision, Public Sector, Processing Agreement, Integrity and Confidentiality Principle, Processors, Processing, Personal Data, Lawful Basis, IP Address ## Summary Data protection authorities powers and cooperation: In the event that the Hungarian DPA should consider that Weltimmo has an establishment not in Hungary, but in another Member State, it may exercise its powers only within its own territory, and it may, irrespective of the applicable law and before even knowing which national law is applicable, thereby investigate the complaint. If it becomes apparent that it is the law of another Member State that applies, that DPA cannot impose penalties outsi ## Sections (15) ### ¶44 With regard, in the first place, to the competence of a supervisory authority to act in such a case, it must be observed that, under Article 28(4) of Directive 95/46, each supervisory authority is to hear claims lodged by any person concerning the protection of his rights and freedoms in regard to the processing of personal data. > Topics: Personal Data, Supervisory Authorities, Supervision, Processing · Applies: gdpr-art-28-par-4-en ### ¶45 Consequently, in a situation such as that at issue in the main proceedings, the Hungarian data protection authority may hear claims lodged by persons, such as the advertisers of properties at issue in the main proceedings, who consider themselves victims of unlawful processing of their personal data in the Member State in which they hold those properties. > Topics: Supervisory Authorities, Integrity and Confidentiality Principle, Personal Data ### ¶46 In the second place, it is necessary to examine what are the powers of that supervisory authority, in the light of Article 28(1), (3) and (6) of Directive 95/46. > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-28-par-1-en ### ¶47 It follows from Article 28(1) of that directive that each supervisory authority established by a Member State is to ensure compliance, within the territory of that Member State, with the provisions adopted by the Member States pursuant to Directive 95/46. > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-28-par-1-en ### ¶48 Pursuant to Article 28(3) of Directive 95/46, those supervisory authorities are in particular to be endowed with investigative powers, such as powers to collect all the information necessary for the performance of their supervisory duties, and effective powers of intervention, such as powers of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, or of warning or admonishing the data controller. > Topics: Processing, Data Controller, Supervision, Controllers · Applies: gdpr-art-28-par-3-en ### ¶49 In view of the non-exhaustive nature of the powers thus listed and the type of powers of intervention mentioned in that provision, as well as the discretion available to the Member States in transposing Directive 95/46, it should be considered that those powers of intervention may include the power to penalise the data controller by imposing on him, where appropriate, a fine. > Topics: Controllers, Data Controller, Processing ### ¶50 The powers granted to the supervisory authorities must be exercised in accordance with the procedural law of the Member State to which they belong. > Topics: Supervision ### ¶51 It is apparent from Article 28(1) and (3) of Directive 95/46 that each supervisory authority is to exercise all of the powers conferred on it on the territory of its own Member State in order to ensure, on that territory, compliance with data protection rules. > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-28-par-1-en ### ¶52 That territorial application of the powers of each supervisory authority is confirmed in Article 28(6) of the directive, which states that each supervisory authority is competent, whatever the national law applicable, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with Article 28(3) of that directive. Article 28(6) of the directive also states that each authority may be requested to exercise its powers by an authority of another Member State and that the supervisory authorities are to cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information. > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-28-par-3-en, gdpr-art-28-par-6-en ### ¶53 That provision is necessary in order to ensure the free flow of personal data in the European Union, whilst ensuring compliance with the rules aimed at protecting the privacy of natural persons laid down in Directive 95/46. In the absence of that provision, where the controller of personal data is subject to the law of a Member State, but infringes the right to the protection of the privacy of natural persons in another Member State, in particular by directing his activity at that other Member State without, however, being established there within the meaning of that directive, it would be difficult, or even impossible, for those persons to enforce their right to that protection. > Topics: Personal Data, Controllers ### ¶54 It thus follows from Article 28(6) of Directive 95/46 that the supervisory authority of a Member State, to which a complaint has been submitted, on the basis of Article 28(4) of that directive, by natural persons in relation to the processing of their personal data, may examine that complaint irrespective of the applicable law, and, consequently, even if the law applicable to the processing of the data concerned is that of another Member State. > Topics: Supervisory Authorities, Supervision, Personal Data · Applies: gdpr-art-28-par-4-en, gdpr-art-28-par-6-en ### ¶55 However, in that case, the powers of that authority do not necessarily include all of the powers conferred on it in accordance with the law of its own Member State. ### ¶56 As the Advocate General observed in point 50 of his Opinion, it follows from the requirements derived from the territorial sovereignty of the Member State concerned, the principle of legality and the concept of the rule of law that the exercise of the power to impose penalties cannot take place, as a matter of principle, outside the legal limits within which an administrative authority is authorised to act subject to the law of its own Member State. ### ¶57 Thus, when a supervisory authority receives a complaint, in accordance with Article 28(4) of Directive 95/46, that authority may exercise its investigative powers irrespective of the applicable law and before even knowing which national law is applicable to the processing in question. However, if it reaches the conclusion that the law of another Member State is applicable, it cannot impose penalties outside the territory of its own Member State. In such a situation, it must, in fulfilment of the duty of cooperation laid down in Article 28(6) of that directive, request the supervisory authority of that other Member State to establish an infringement of that law and to impose penalties if that law permits, based, where necessary, on the information which the authority of the first Member State has transmitted to the authority of that other Member State. > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-28-par-4-en, gdpr-art-28-par-6-en ### ¶58 The supervisory authority to which such a complaint has been submitted may, in the context of that cooperation, find it necessary to carry out other investigations, on the instructions of the supervisory authority of the other Member State. > Topics: Supervisory Authorities, Supervision ## Cited law provisions (4) ### GDPR — gdpr-art-28-par-1-en Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. ### GDPR — gdpr-art-28-par-3-en Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ### GDPR — gdpr-art-28-par-4-en Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations. ### GDPR — gdpr-art-28-par-6-en Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. --- Generated by overview.legal · https://overview.legal/posts/5956 · 2026-08-22