A landmark judgement has been reached this morning by the European Court of Justice (ECJ) on data protection legislation in the case of Weltimmo which will have far reaching implications for tech giants processing data in Europe, including Facebook and Google.
The ECJ ruled that ‘data protection legislation of a Member State may be applied to a foreign company which exercises in that State’. It found that ‘each Member State must apply the provisions it adopted pursuant to the directive where the data processing is carried out’. In addition, the court found that ‘the concept of ‘establishment’ extends to any real and effective activity – even a minimal one.’
The precedent set is that ‘each supervisory authority established by a member state must ensure compliance, within the territory of that state, with the provisions adopted by all member states pursuant to the directive. Consequently, each supervisory authority is to hear claims lodged by any person concerning the protection of his rights and freedoms in regard to the processing of personal data, even if the law applicable to that processing is the law of another Member State.’
Ashley Winton, UK head of data protection and privacy at international law firm Paul Hastings, is available for comment on the significance of the above. Ashley specialises in Global Banking and Cybersecurity and advises multinational corporations and government and non-government agencies on technology, cyber security and data privacy. He is available today and tomorrow to provide written and spoken statements.