The Court of Justice of the European Union is due to give judgment Thursday in what may prove to be one of the more significant data protection cases of 2016. This is case C-191/15: Verein für Konsumenteninformation v Amazon. The ECJ is being asked to consider which Member State’s data protection law should apply where goods are sold across national borders but within the EU; for example, in the case goods are sold from a German or Luxembourgish website to an Austrian consumer.
VKI v Amazon is particularly significant because the EU is in the process of implementing its new General Data Protection Regulation. The GDPR will create a European Data Protection Board made up of the data protection authorities of different Member States, supported by the EDPS. One of the functions of the EDPB will be the management of such conflicts of jurisdiction. Unfortunately, the GDPR requires that the EDPB do so through a convoluted process that has been described as a “ … hyper bureaucratic procedure that will lead to more complexity and longer procedures.”
If the ECJ clarifies the jurisdiction of DPAs then there may be less need to utilise these hyper-bureaucratic procedures, which may make the EU’s single market more efficient. Clarity will help EU DPAs by reducing the very significant workloads that participation in the EDPB will impose. Clarity will also help data controllers by letting them know which DPA is supervising them and help subjects by clarifying which DPA to whom they should complain.
In VKI v Amazon, an Austrian consumer rights agency VKI has asked the ECJ to answer a number of questions ending with the following: “Is the processing of personal data by an undertaking that in the course of electronic commerce concludes contracts with consumers resident in other Member States … governed exclusively by the law of the Member State in which the establishment of the undertaking is situated … or must the undertaking also comply with the data protection rules of those Member States to which its commercial activities are directed?”
In the case, the ECJ is being asked to clarify its judgment in Weltimmo, issued last year. In that case the ECJ held that the data protection law of a Member State would apply to a data controller insofar as they exercised: “ … through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.” Such stable arrangements might include a website that was directed at a Member State and written in its language as well as employing a representative in the Member State who was authorised to collect debts and appear in court.
What makes VKI v Amazon of particular interest is that the ECJ may consider whether there is any need to reconcile Weltimmo with its previous judgment in González v Google Spain. The ECJ took a somewhat different approach to deciding jurisdiction these cases. That difference may be explained by the fact that Weltimmo concerned a conflict of jurisdiction between two EU Member States.
In Weltimmo there was no doubt that EU data protection law was going to apply; the only question was which one. In contrast, González v Google Spain concerned a conflict of jurisdiction between Spain and California. EU data protection law would not apply if the ECJ resolved the conflict of jurisdiction in favor of the latter; hence the ECJ took a more broad view of what was meant by establishment to ensure that EU data protection law applied in González v Google Spain.
Such a view was taken by Advocate General Saugmandsgaard Øe in his opinion in VKI v Amazon, which was issued in June. It was his opinion that a personal data processing operation can be subject only to the laws of a single Member State. That Member State would be the one in which the data controller has a fixed establishment through which it carries on a real and effective activity. This is something for national courts to assess.
Thursday will unveil what the ECJ’s judgment will be. That judgment may follow the opinion of Advocate General Saugmandsgaard Øe, or it may not. Judgments of the ECJ often follow the Opinions of its Advocate General, though not as often as some may think, as one recent study suggests this happens about two-thirds of the time.
photo credit: Berlaymont via photopin (license)