In respect of the second main issue, the Advocate General stated that, in determining whether the ULD was able to exercise its powers against Facebook entities outside of Germany, it was necessary to show that the German regulator was entitled to apply its own national law and that this required two conditions to be met. First, the controller must have an establishment in Germany, and second the processing must be undertaken ‘in the context of the activities’ of that establishment.

It was the Advocate General’s opinion that under Article 4(1)(a) of the Data Projection Directive, an ‘establishment’ should, in accordance with the case of Google Spain SL & Google Inc v Agencia Española de Protección de Datos (AEPD) & Mario Costeja González Case C-131/12, be interpreted broadly to include any company that undertakes any ‘real and effective activity, even a minimal one’ and Facebook Germany was therefore an establishment of Facebook Ireland.

For German member state law to apply, it merely required that the processing be conducted in the ‘context of the activities’ of the establishment. In this case, because Facebook Germany was responsible for the promotion and sale of advertising space in its country, and this activity was reliant on the processing of personal data, its business activities were ‘indissolubly’ linked to those of Facebook Ireland. Therefore, the two-stage test was met, meaning that Facebook is required to comply with German law in respect of its activities on German territory and is subject to the UDG’s powers of enforcement.

Finally, the Advocate General concluded that, as the entity with decisive influence over the processing could be pursued for any alleged infringements of the Data Projection Directive, so it would follow that action could be taken directly against Facebook Ireland. In the Advocate General’s view, the fact that ULD may exercise its powers of intervention against Facebook Inc and Facebook Ireland in no way would prevent it from also taking measures against the Wirtschaftsakademie.

On the third main issue, the Advocate General argued that on the facts of this case, including because in this case the applicable law is that of the Member State of the supervisory authority that wishes to exercise its powers of intervention, that Article 28(6) of the Data Protection Directive should be interpreted such that the ULD is entitled to exercise its powers of intervention against Facebook Ireland with complete independence and without being required first to call on the Irish supervisory authority.

What are the implications for Wirtschaftsakademie, and other companies who use Facebook for advertising?

At present, this is only the Opinion of the Advocate General and is not in itself legally binding. However, if the Court of Justice agrees with the Opinion, then the German courts may rule that the lower courts were wrong in setting aside the UDG’s original order. This could result in Wirtschaftsakademie being forced to take down its fan page.

Equally, the potential implications of this Opinion on other EU companies who advertise through Facebook are considerable. The UDG and other supervisory authorities across the EU may use any equivalent Court of Justice ruling as authority for taking action against such companies on the basis that they are data controllers who are infringing data protection laws. The risk of this happening, along with the potential for higher fines under the General Data Protection Regulation, (EU) 2016/679 (GDPR), may force advertisers to be more cautious in their use of Facebook, and other social media platforms, and put pressure on these companies into providing greater assurances about the legality of their data processing techniques.

To what extent will controllers based in one Member State now be expected to comply with the laws of other Member States?

Even if the Court of Justice follows this Opinion, there are two primary reasons why it is unlikely to have a substantial effect on controllers at this time. Firstly, the right for the UDG to exercise its powers across Member State borders follows from the 2015 Weltimmo s.r.o v Nemzeti Adatvédelmi és Információszabadság Hatóság Case C-230/14 judgment. This case involved a question of whether the Hungarian supervisory authority was entitled to impose a fine on a service provider that was domiciled in Austria. The court used the same two-stage test outlined above to establish whether the law of Hungary applied to the Austrian company’s data processing, and found that it did; therefore confirming the right of a supervisory authority to fine a company across Member State borders.

Secondly, when the GDPR takes effect on 25 May 2018, it introduces a new ‘one-stop-shop’ mechanism which will override the rulings made in this case and Weltimmo. Under one-stop-shop, where there is cross-border processing involved, the controller will be subject to the jurisdiction of a single lead supervisory authority whose identity will be determined by the country in which the ‘main establishment’ of the controller is based. Applying these new rules to this case would most likely mean that the Irish supervisory authority would be the lead supervisory authority, and the UDG’s role would be limited to cooperating with them as outlined under Article 60 of the GDPR.

This article was first published on Lexis®PSL 8 November 2017.  Lexis®PSL.