WP29 has updated its opinion on applicable law in light of Google Spain SL and Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez Case C-131/12 to take into account the territorial scope of Article 4 of the Data Protection Directive (95/46/EC).
The updated opinion looks at the issue of which law applies when a non-EU company has several establishments in different member states and a designated EU headquarters in one specific member state, which carries out the data processing functions. The updated opinion states that the Directive does not allow for the sole application of the law of the member state in which the EU headquarters is based. Instead the data protection law of each member state where there is an establishment is applicable.
The new Directive is due to come into force in 2018. Its text was agreed in December 2015. We will be publishing a specialised bulletin with our analysis on the Directive in due course.
Update of opinion 8/2010 on applicable law in light of the CJEU judgement in Google Spain can be found here.