The CJEU has handed down another landmark data protection ruling this October in the case of Weltimmo. The case concerned a website run by a Slovakian company, advertising to and collecting personal data from residents in Hungary. The Slovakian company had one representative present in Hungary. Previously, multinational businesses had been subject only to data protection regulation in  the Member State in which they were registered. However, the CJEU held that where the entity had an establishment in Hungary (one representative, a bank account and a letter box in the country was sufficient for such establishment) and data was processed for activities in Hungary, the data protection regulations of Hungary applied to that processing. These applied in addition to the regulation by the Slovakian data protection authority. Therefore data protection regulations in each Member State in which a company operates should be complied with.

The Court considered that the Hungarian data protection authority was able to hear and investigate the complaint but could not enforce it. Instead, the Hungarian data protection authority would need to request cooperation from the Slovakian authority.

CJEU Decision