The Article 29 Working Party (WP29) has updated its Opinion on applicable law and has introduced a new ‘inextricable link’ test representing a new element to the existing ‘in the context of the activities of an establishment’ criteria. This updated Opinion follows the Court of Justice of the European Union’s (CJEU) judgment in the case of Google Spain.
The update addresses the territorial scope of the Data Protection Directive (95/46/EC) (the Directive), and is particularly relevant to search engine providers.
The WP29 provides clarification on the following points:
- Confirms the decision in Weltimmo (which we reported on earlier this year), and gives a broad interpretation to the term ‘establishment’.
- Provides that processing personal data does not necessarily need to be carried out ‘by’ the establishment itself. It is sufficient if the processing is carried out ‘in the context of the activities’ of the establishment.
- In determining whether processing is ‘in the context of the activities’ of the establishment, the courts will consider that there is an ‘inextricable link’ between activities in the Member State and the data processing, regardless of where that processing takes place.
- Where an organisation has multiple EU establishments, the applicable law should be determined using the ‘inextricable link’ test on a case-by-case basis: the consequence of which is that organisations such as these may need to comply with the laws of each applicable Member State.
In Google Spain, an ‘inextricable link’ was found between the data processing activities carried out by Google’s U.S. search engine and its Spanish establishment. The CJEU found that without the advertising activities of Google’s establishment in Spain, it would not have been economically feasible for Google to provide a search engine service.
The updated Opinion will be of particular importance to non-EU organisations with multiple EU operations, as it confirms that an establishment does not need to be directly involved in the processing to bring it within the scope of the Directive; it is enough if an inextricable link can be found between the processing activities of a non-EU data controller and an establishment in the EU. Organisations must therefore be aware of the long arm of the Directive (and of course the associated compliance burdens), particularly if they have establishments in the EU which promote and sell advertising space, raise revenues, or offer free, subscription or membership services within the EU.