A Collection is a selection of features, articles, comments and opinions on any given theme or topic. It allows you to stay up‑to‑date with what interests you most.
Login here to access your saved articles and followed authors.
We have sent you an email so you can reset your password.
Sorry, we had a problem.
Tags related to this article
Published 19 April 2016
Where a data controller is operating in different member states, it raises the question of whether companies need to comply with only one EU national data protection law or with the laws of all member states in which they have a relevant 'establishment' within the meaning of Article 4(1)(a) of the European Directive 95/46/EC ("Directive").
A woman complained to the Hamburg Data Protection Authority (the "DPA") against Facebook for changing her chosen username from that of a pseudonym to her real name. The DPA found that Facebook could not change users' chosen usernames to their real names as German data protection law provides a right to a pseudonymised online profile (the "Order"). However, the Administrative Court of Hamburg recently overturned the Order and held that Irish data protection law applied irrespective of there being a Facebook office in Germany (the "Ruling"). In its Ruling, the business operations of Facebook Ireland and Facebook Germany both constituted 'establishments' within the meaning of the Directive. However it was held to be the law of the member state in which the disputed data processing is most closely associated with that applied. In this case, the laws of Ireland were held to be applicable on the basis that Facebook's European headquarters were in Ireland.
The Ruling indicates that Article 4(1)(a) of the Directive can be interpreted so that multi-national companies, such as Facebook, may avoid having to comply with conflicting national data protection laws of all applicable member states. It should be noted however, that the Ruling does contrast with the Weltimmo decision in which a broad interpretation of 'establishment' was taken i.e. if a data controller exercises "a real and effective activity – even a minimal one [through] stable arrangements" in a member state there will be an establishment.
The GDPR, when in force, will replace the Directive, and will have limited scope for deviations under national laws, therefore removing the issue of the conflicting laws in different member states. The GDPR also advocates a 'one-stop-shop' whereby the supervisory authority for the main establishment of the data controller will be the lead authority on ensuring compliance by that company throughout the EU. Whilst it is unclear as to how the 'one-stop-shop' will work in practice, this promise of greater clarity will be welcomed by companies operating across the EU.
Organisations should bear in mind that under the current European regime the relevant data protection laws will be those of the member state with which the data processing is most closely associated, which may not always be where the data subject, or indeed an establishment, is located.
To read the text of the Ruling, please click here. (German)
To read the press release on the Ruling from the DPA, please click here.
Submitted by Rhiannon Webster , Partner and Shehana Cameron-Perera, Trainee Solicitor
Return to main page >>>
London - Walbrook
+44 (0)20 7894 6577
Richard Highley, Kevin Hawthorn, Francesca Muscutt
Richard Highley, Giles Hindle, Naomi Park, Julian Bubb Humfryes, Francesca Muscutt, Tim Ryan, Annabel Walker, Rebecca Smith, Suzanne Wharton, Amy Beaumont
Richard Highley, Kevin Hawthorn, Naomi Park
Richard Highley, Francesca Muscutt, Suzanne Wharton, Naomi Park, Christopher Stoate
Richard Highley, Ross Risby, Suzanne Wharton, Rhiannon Webster, Francesca Muscutt, Shehana Cameron Perera, Gareth Robinson, Melissa Darley, William Naylor
Richard Highley, Lorraine Ekong
Richard Highley, Ross Risby, Suzanne Wharton, Naomi Park, Rebecca Smith, Sarah Crowther, Hannah Gregory, Declan Finn, Dan Preddy
Richard Highley, Ross Risby, Suzanne Wharton, Naomi Park, Francesca Muscutt, Rebecca Smith
Richard Highley, Pippa Ellis, Martin Langley, Kevin Hawthorn, Giles Hindle, Ross Risby, Beverley Atkinson
Richard Highley, Naomi Park, Suzanne Wharton, Hans Allnutt, Ross Risby, Mathew Rutter
Richard Highley, Francesca Muscutt, Kevin Hawthorn, Giles Hindle, Martin Langley, Naomi Park, Suzanne Wharton, Ross Risby, Julian Miller
Richard Highley, Ross Risby, Julian Miller
Richard Highley, William Naylor, Giles Hindle, Julian Miller, Pippa Ellis, Patrick Hill, Declan Finn, Ross Risby, Suzanne Wharton
Richard Highley, Ross Risby, Julian Miller, Suzanne Wharton, Giles Hindle
Richard Highley, Naomi Park, Julian Miller, Giles Hindle, Ross Risby
Richard Highley, Julian Miller, John Dunlop, Dan Preddy, Paul Davison, Ian McConkey, Ross Risby, Marcus Campbell