Cross-Border Data Protection: Applicable Law and Territorial powers of National Data Protection Supervisors

Abstract

This commentary analyses the European Court of Justice preliminary ruling in Case C230/14 Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság, on the interpretation of two important aspects of Directive 95/46/EC, namely the applicable law, and territorial reach of, national data protection authorities. The Court ruled that the data protection legislation of a member state may be applied by the national data protection authority to a foreign registered company which exercises, through stable arrangements, real and effective (albeit minimal) activity in that member state. This is a ruling that potentially increases compliance costs for entities operating across multiple European jurisdictions pending the introduction of the General Data Protection Regulation.