—

the Nemzeti Adatvédelmi és Információszabadság Hatóság, by A. Péterfalvi, acting as Agent, and by G. Dudás, ügyvéd,

—

the Hungarian Government, by M. Z. Fehér, G. Koós and A. Pálfy, acting as Agents,

—

the Polish Government, by B. Majczyna, M. Kamejsza and M. Pawlicka, acting as Agents,

—

the Slovak Government, by B. Ricziová, acting as Agent,

—

the United Kingdom Government, by M. Holt, acting as Agent, and by J. Holmes, Barrister,

—

the European Commission, by A. Tokár, B. Martenczuk and J. Vondung, acting as Agents,

1

This request for a preliminary ruling concerns the interpretation of Articles 4(1)(a) and 28(1), (3) and (6) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

2

The request has been made in proceedings between Weltimmo s. r. o. (‘Weltimmo’), a company which has its registered office in Slovakia, and the Nemzeti Adatvédelmi és Információszabadság Hatóság (the national authority for data protection and freedom of information; ‘the Hungarian data protection authority’) concerning a fine imposed by the latter for infringement of Law CXII of 2011 on the right to self-determination as regards information and freedom of information (az információs önrendelkezési jogról és az információszabadságról szóló 2011. évi CXII. törvény; ‘the Law on information’), which transposed Directive 95/46 into Hungarian law.

3

Recitals 3, 18 and 19 in the preamble to Directive 95/46 state:

…

4

Article 2 of Directive 95/46 provides:

‘For the purposes of this Directive:

…

…’

5

Article 4(1)(a) of Directive 95/46 provides:

‘1.   Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:

6

According to Article 28(1), (3) and (6) of Directive 95/46:

‘1.   Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

…

3.   Each authority shall in particular be endowed with:

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

…

6.   Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.’

7

Paragraph 2(1) of the Law on information provides:

‘This Law shall apply to all data processing operations and technical manipulation of data carried out in the territory of Hungary that pertain to the data of natural persons or to public information or information of public interest.’

8

Paragraph 3(10) and (17) of the Law on information contains the following definitions:

‘(10)   “data processing” shall mean any operation or set of operations that is performed upon data, whether or not by automatic means, such as in particular collection, recording, organisation, storage, adaptation or alteration, use, retrieval, transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, and blocking them from further use, photographing, sound and video recording, and the recording of physical attributes for identification purposes (such as fingerprints and palm prints, DNA samples and retinal images);

…

(17)   “technical manipulation of data” [“adatfeldolgozás”] shall mean the technical operations involved in data processing, irrespective of the method and instruments employed for such operations and the venue where it takes place, provided that such technical operations are carried out on the data. ’

9

Weltimmo, a company registered in Slovakia, runs a property dealing website concerning Hungarian properties. For that purpose, it processes the personal data of the advertisers. The advertisements are free of charge for one month but thereafter a fee is payable. Many advertisers sent a request by e-mail for the deletion of both their advertisements and their personal data as from that period. However, Weltimmo did not delete those data and charged the interested parties for the price of its services. As the amounts charged were not paid, Weltimmo forwarded the personal data of the advertisers concerned to debt collection agencies.

10

Those advertisers lodged complaints with the Hungarian data protection authority. That authority declared that it was competent under Paragraph 2(1) of the Law on information, taking the view that the collection of the data concerned constituted processing of data or a technical operation for the processing of data concerning natural persons. Considering that Weltimmo had infringed the Law on information, that data protection authority imposed on that company a fine of HUF 10 million (approximately EUR 32000).

11

Weltimmo then brought an action before the Budapest administrative and labour court (Fővárosi Közigazgatási és Munkaügyi Bíróság), which held that the fact that that company did not have a registered office or branch in Hungary was not a valid argument in defence because the processing of data and the supply of data services relating to the Hungarian property concerned had taken place in Hungary. However, that court set aside the decision of the Hungarian data protection authority on other grounds, connected with the lack of clarity over some of the facts.

12

Weltimmo appealed on a point of law to the referring court, claiming that there was no need for further clarification of the facts, since, pursuant to Article 4(1)(a) of Directive 95/46, the Hungarian data protection authority in this case was not competent and could not apply Hungarian law in respect of a supplier of services established in another Member State. Weltimmo maintained that, under Article 28(6) of Directive 95/46, that authority should have asked the Slovak data protection authority to act in its place.

13

The Hungarian data protection authority submitted that Weltimmo had a Hungarian representative in Hungary, namely one of the owners of that company, who represented it in the administrative and judicial proceedings that took place in that Member State. That authority added that Weltimmo’s Internet servers were probably installed in Germany or in Austria, but that the owners of that company lived in Hungary. Lastly, according to that authority, it follows from Article 28(6) of Directive 95/46 that it was in any event competent to act, regardless of the applicable law.

14

Since it had doubts concerning the determination of the applicable law and the powers of the Hungarian data protection authority under Articles 4(1) and 28 of Directive 95/46, the Kúria (Supreme Court, Hungary) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

15

As regards, first of all, the factual context of the main proceedings, certain additional information, which was submitted by the Hungarian data protection authority in its written observations and at the hearing before the Court, should be mentioned.

16

It is apparent from that information, first, that that authority informally learned from its Slovak counterpart that Weltimmo did not carry out any activity at the place where it has its registered office, in Slovakia. Moreover, on several occasions, Weltimmo moved that registered office from one State to another. Secondly, Weltimmo developed two property dealing websites, written exclusively in Hungarian. It opened a bank account in Hungary, which was intended for the recovery of its debts, and had a letter box in that Member State for its everyday business affairs. The post was regularly picked up and sent to Weltimmo by electronic means. Thirdly, the advertisers themselves not only had to enter the data relating to their properties on Weltimmo’s website, but also had to delete those data from that website if they did not want those data to continue to appear on the website after the end of the one-month period mentioned above. Weltimmo raised a computer management issue in order to explain why it had not been possible to carry out that erasure. Fourthly, Weltimmo is a company made up of only one or two persons. Its representative in Hungary tried to negotiate the settlement of the unpaid debts with the advertisers.

17

As regards, next, the wording of the questions referred, although the referring court uses the words ‘established only’ in its first and second questions, it is apparent from the order for reference and the written and oral observations submitted by the Hungarian data protection authority that, whilst Weltimmo is registered in Slovakia and is therefore established in that Member State, within the meaning of company law, there is uncertainty as to whether it is ‘established’ only in that Member State, within the meaning of Article 4(1)(a) of Directive 95/46. By referring a question to the Court regarding the interpretation of that provision, the referring court seeks to ascertain what is covered by the concept of ‘establishment’ used in that provision.

18

Lastly, it must be observed that, in the first and second questions, the referring court mentions that the server used by Weltimmo is installed in Slovakia, whereas, in another passage in the order for reference, it mentions the possibility that that company’s servers may be in Germany or in Austria. In those circumstances, it seems appropriate to consider that the question as to the Member State in which the server or servers used by that company are installed is not settled.

19

By its first to sixth questions, which should be examined together, the referring court asks, in essence, whether Articles 4(1)(a) and 28(1) of Directive 95/46 must be interpreted as permitting, in circumstances such as those at issue in the main proceedings, the data protection authority of a Member State to apply its national law on data protection with regard to a data controller whose company is registered in another Member State and who runs a property dealing website concerning properties situated in the territory of the first of those two States. In particular, the referring court asks whether it is significant that that Member State is the Member State:

20

As regards the applicable law, the referring court refers in particular to Slovak and Hungarian law, Slovak law being the law of the Member State in which the controller of the personal data concerned is registered and Hungarian law being the law of the Member State mentioned by the websites at issue in the main proceedings, in the territory of which the properties forming the subject-matter of the published advertisements are situated.

21

In that regard, it should be noted that Article 4 of Directive 95/46, entitled ‘National law applicable’, which is found in the first Chapter of that directive, entitled ‘General provisions’, specifically governs the question raised.

22

By contrast, Article 28 of Directive 95/46, entitled ‘Supervisory authority’, deals with the role and powers of that authority. Pursuant to Article 28(1) of Directive 95/46, that authority is responsible for monitoring the application, within the territory of its own Member State, of the provisions adopted by the Member States pursuant to that directive. In accordance with Article 28(6) of that directive, the supervisory authority exercises the powers conferred on it, whatever the national law applicable to the processing of personal data.

23

The national law applicable to the controller in respect of that processing must therefore be determined not in the light of Article 28 of Directive 95/46, but in the light of Article 4 of that directive.

24

As set out in Article 4(1)(a) of Directive 95/46, each Member State is to apply the national provisions it adopts pursuant to that directive to the processing of personal data where the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State.

25

In the light of the objective pursued by Directive 95/46, consisting in ensuring effective and complete protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data, the words ‘in the context of the activities of an establishment’ cannot be interpreted restrictively (see, to that effect, judgment in Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 53).

26

In order to achieve that objective and to ensure that individuals are not deprived of the protection to which they are entitled under that directive, recital 18 in the preamble to that directive states that any processing of personal data in the European Union must be carried out in accordance with the law of one of the Member States and that processing carried out under the responsibility of a controller who is established in a Member State should be governed by the law of that State.

27

The EU legislature thus prescribed a particularly broad territorial scope of Directive 95/46, which it registered in Article 4 thereof (see, to that effect, judgment in Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 54).

28

With regard, in the first place, to the concept of ‘establishment’, it should be noted that recital 19 in the preamble to Directive 95/46 states that establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements and that the legal form of such an establishment, whether simply a branch or a subsidiary with a legal personality, is not the determining factor (judgment in Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 48). Moreover, that recital states that, when a single controller is established on the territory of several Member States, he must ensure, in order to avoid any circumvention of national rules, that each of the establishments fulfils the obligations imposed by the national law applicable to its activities.

29

As the Advocate General observed, in essence, in points 28 and 32 to 34 of his Opinion, this results in a flexible definition of the concept of ‘establishment’, which departs from a formalistic approach whereby undertakings are established solely in the place where they are registered. Accordingly, in order to establish whether a company, the data controller, has an establishment, within the meaning of Directive 95/46, in a Member State other than the Member State or third country where it is registered, both the degree of stability of the arrangements and the effective exercise of activities in that other Member State must be interpreted in the light of the specific nature of the economic activities and the provision of services concerned. This is particularly true for undertakings offering services exclusively over the Internet.

30

In that regard, it must, in particular, be held, in the light of the objective pursued by that directive, consisting in ensuring effective and complete protection of the right to privacy and in avoiding any circumvention of national rules, that the presence of only one representative can, in some circumstances, suffice to constitute a stable arrangement if that representative acts with a sufficient degree of stability through the presence of the necessary equipment for provision of the specific services concerned in the Member State in question.

31

In addition, in order to attain that objective, it should be considered that the concept of ‘establishment’, within the meaning of Directive 95/46, extends to any real and effective activity — even a minimal one — exercised through stable arrangements.

32

In the present case, the activity exercised by Weltimmo consists, at the very least, of the running of one or several property dealing websites concerning properties situated in Hungary, which are written in Hungarian and whose advertisements are subject to a fee after a period of one month. It must therefore be held that that company pursues a real and effective activity in Hungary.

33

Furthermore, it is apparent in particular from the information provided by the Hungarian data protection authority that Weltimmo has a representative in Hungary, who is mentioned in the Slovak companies register with an address in Hungary and who has sought to negotiate the settlement of the unpaid debts with the advertisers. That representative served as a point of contact between that company and the data subjects who lodged complaints and represented the company in the administrative and judicial proceedings. In addition, that company has opened a bank account in Hungary, intended for the recovery of its debts, and uses a letter box in that Member State for the management of its everyday business affairs. That information, which it is for the referring court to verify, is capable of establishing, in a situation such as that at issue in the main proceedings, the existence of an ‘establishment’ within the meaning of Article 4(1)(a) of Directive 95/46.

34

In the second place, it is necessary to establish whether the processing of personal data at issue is carried out ‘in the context of the activities’ of that establishment.

35

The Court has already held that Article 4(1)(a) of Directive 95/46 requires the processing of personal data in question to be carried out not ‘by’ the establishment concerned itself, but only ‘in the context of the activities’ of the establishment (judgment in Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 52).

36

In the present case, the processing at issue in the main proceedings consists, inter alia, of the publication, on Weltimmo’s property dealing websites, of personal data relating to the owners of those properties and, in some circumstances, of the use of those data for the purpose of the invoicing of the advertisements after a period of one month.

37

In this respect, it should be observed that, as regards in particular the Internet, the Court has already had occasion to state that the operation of loading personal data on an Internet page must be considered to be ‘processing’ within the meaning of Article 2(b) of Directive 95/46 (judgments in Lindqvist, C‑101/01, EU:C:2003:596, paragraph 25, and Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 26).

38

There is no doubt that that processing takes place in the context of the activities, as described in paragraph 32 of this judgment, which Weltimmo pursues in Hungary.

39

Therefore, subject to the checks referred to in paragraph 33 of this judgment, which it is for the referring court to carry out for the purpose of establishing, should that be the case, the existence of an establishment of the controller in Hungary, it must be held that that processing is carried out in the context of the activities of that establishment and that Article 4(1)(a) of Directive 95/46 permits, in a situation such as that at issue in the main proceedings, the application of the Hungarian law on the protection of personal data.

40

By contrast, the fact that the owners of the properties forming the subject-matter of the advertisements have Hungarian nationality is of no relevance whatsoever for the purposes of determining the national law applicable to the processing of the data at issue in the main proceedings.

41

In the light of all the foregoing considerations, the answer to the first to sixth questions is as follows:

42

The seventh question is asked only in the event that the Hungarian data protection authority should consider that Weltimmo has, not in Hungary but in another Member State, an establishment, within the meaning of Article 4(1)(a) of Directive 95/46, performing activities in the context of which the processing of the personal data concerned is carried out.

43

By that question, the referring court asks, in essence, whether, should the Hungarian data protection authority reach the conclusion that the law applicable to the processing of the personal data is not Hungarian law, but the law of another Member State, Article 28(1), (3) and (6) of Directive 95/46 should be interpreted as meaning that that authority would be able to exercise only the powers provided for by Article 28(3) of that directive, in accordance with the law of that other Member State, and would not be able to impose penalties.

44

With regard, in the first place, to the competence of a supervisory authority to act in such a case, it must be observed that, under Article 28(4) of Directive 95/46, each supervisory authority is to hear claims lodged by any person concerning the protection of his rights and freedoms in regard to the processing of personal data.

45

Consequently, in a situation such as that at issue in the main proceedings, the Hungarian data protection authority may hear claims lodged by persons, such as the advertisers of properties at issue in the main proceedings, who consider themselves victims of unlawful processing of their personal data in the Member State in which they hold those properties.

46

In the second place, it is necessary to examine what are the powers of that supervisory authority, in the light of Article 28(1), (3) and (6) of Directive 95/46.

47

It follows from Article 28(1) of that directive that each supervisory authority established by a Member State is to ensure compliance, within the territory of that Member State, with the provisions adopted by the Member States pursuant to Directive 95/46.

48

Pursuant to Article 28(3) of Directive 95/46, those supervisory authorities are in particular to be endowed with investigative powers, such as powers to collect all the information necessary for the performance of their supervisory duties, and effective powers of intervention, such as powers of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, or of warning or admonishing the data controller.

49

In view of the non-exhaustive nature of the powers thus listed and the type of powers of intervention mentioned in that provision, as well as the discretion available to the Member States in transposing Directive 95/46, it should be considered that those powers of intervention may include the power to penalise the data controller by imposing on him, where appropriate, a fine.

50

The powers granted to the supervisory authorities must be exercised in accordance with the procedural law of the Member State to which they belong.

51

It is apparent from Article 28(1) and (3) of Directive 95/46 that each supervisory authority is to exercise all of the powers conferred on it on the territory of its own Member State in order to ensure, on that territory, compliance with data protection rules.

52

That territorial application of the powers of each supervisory authority is confirmed in Article 28(6) of the directive, which states that each supervisory authority is competent, whatever the national law applicable, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with Article 28(3) of that directive. Article 28(6) of the directive also states that each authority may be requested to exercise its powers by an authority of another Member State and that the supervisory authorities are to cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

53

That provision is necessary in order to ensure the free flow of personal data in the European Union, whilst ensuring compliance with the rules aimed at protecting the privacy of natural persons laid down in Directive 95/46. In the absence of that provision, where the controller of personal data is subject to the law of a Member State, but infringes the right to the protection of the privacy of natural persons in another Member State, in particular by directing his activity at that other Member State without, however, being established there within the meaning of that directive, it would be difficult, or even impossible, for those persons to enforce their right to that protection.

54

It thus follows from Article 28(6) of Directive 95/46 that the supervisory authority of a Member State, to which a complaint has been submitted, on the basis of Article 28(4) of that directive, by natural persons in relation to the processing of their personal data, may examine that complaint irrespective of the applicable law, and, consequently, even if the law applicable to the processing of the data concerned is that of another Member State.

55

However, in that case, the powers of that authority do not necessarily include all of the powers conferred on it in accordance with the law of its own Member State.

56

As the Advocate General observed in point 50 of his Opinion, it follows from the requirements derived from the territorial sovereignty of the Member State concerned, the principle of legality and the concept of the rule of law that the exercise of the power to impose penalties cannot take place, as a matter of principle, outside the legal limits within which an administrative authority is authorised to act subject to the law of its own Member State.

57

Thus, when a supervisory authority receives a complaint, in accordance with Article 28(4) of Directive 95/46, that authority may exercise its investigative powers irrespective of the applicable law and before even knowing which national law is applicable to the processing in question. However, if it reaches the conclusion that the law of another Member State is applicable, it cannot impose penalties outside the territory of its own Member State. In such a situation, it must, in fulfilment of the duty of cooperation laid down in Article 28(6) of that directive, request the supervisory authority of that other Member State to establish an infringement of that law and to impose penalties if that law permits, based, where necessary, on the information which the authority of the first Member State has transmitted to the authority of that other Member State.

58

The supervisory authority to which such a complaint has been submitted may, in the context of that cooperation, find it necessary to carry out other investigations, on the instructions of the supervisory authority of the other Member State.

59

It follows that, in a situation such as that at issue in the main proceedings, if the applicable law is that of a Member State other than Hungary, the Hungarian data protection authority will not be able to exercise the powers to impose penalties which Hungarian law has conferred on it.

60

It follows from the foregoing considerations that the answer to the seventh question is that, where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

61

By its eighth question, the referring court seeks an interpretation from the Court of the scope of the term ‘adatfeldolgozás’ (technical manipulation of data) used in particular in Article 4(1)(a) of Directive 95/46, relating to the determination of the applicable law, and in Article 28(6) of that directive, relating to the competence of the supervisory authority.

62

It is apparent from Directive 95/46, in the Hungarian version thereof, that that version consistently uses the term ‘adatfeldolgozás’.

63

The referring court states that, in particular in its provisions designed to implement the provisions of Directive 95/46 relating to the competence of the supervisory authorities, the Law on information uses the term ‘adatkezelés’ (data processing). However, as is apparent from Paragraph 3(10) of that law, that term has a broader meaning than that of the term ‘adatfeldolgozás’, defined in Paragraph 3(17) of that law, and encompasses the latter term.

64

Whilst, according to its usual meaning and as is apparent from the Law on information, the term ‘adatfeldolgozás’ has a narrower meaning than the term ‘adatkezelés’, it must however be observed that the Hungarian version of Directive 95/46 defines the term ‘adatfeldolgozás’ in Article 2(b) thereof in a broad manner, corresponding to the term ‘adatkezelés’.

65

It follows that the answer to the eighth question is that Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

66

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules: