Establishment in the EU

Key References:

Breaking down the definition of Art. 3(1):

This Regulation applies to the processing of personal data
in the context of the activities of an establishment of a controller or a processor in the Union,
regardless of whether the processing takes place in the Union or not.

Recital 22

Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union.
Establishment implies the effective and real exercise of activity through stable arrangements.
The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

The CJEU considered the arrangement of an EU sales office which was a subsidiary of Google (a US based company) and held that the EU subsidiary was an establishment of Google because it was “inextricably linked” to Google USA, had stable arrangements with Google USA, and it processed personal data “in context of the activities” of the establishment.

Facts: Weltimmo was a Slovakian registered company that ran a website concerning properties in Hungary and processed the personal data of Hungarian residents. Weltimmo did not have a registered office or branch in Hungary though it had a representative in Hungary, a bank account and mailbox. Its website was in the Hungarian language.
Issue: The question before the CJEU was whether Weltimmo had an “establishment” in Hungary.
Analysis:
- The CJEU considered the concept of establishment and held that the term is not limited to formal legal definitions, and should be read in a broad and flexible manner.
- The CJEU held that the concept of establishment requires looking at the controller or processor’s effective exercise of activities… the degree of stability of the arrangements…in the light of the specific nature of the economic activities and the provision of services concerned. This is particularly true for undertakings offering services exclusively over the Internet.
- The CJEU found that Weltimmo’s stable presence in Hungary, however small, and proactive advertisement of its services to Hungarian residents in their language were sufficient activities that met the concept of establishment.
Holding: The CJEU held that under the definition of Directive 1995, Weltimmo was considered an establishment in Hungary. (Note: This case continues to be relevant under the GDPR).

Facts: Amazon was incorporated in Luxembourg and had a presence in Austria through its website (.de with German language pages) through which it entered into contracts with Austrian residents. Amazon had no registered office in Austria and its terms of agreement for its contracted stated that it was bound by the law of Luxembourg where it was registered. VKI, an Austrian company, argued that Amazon was established under Austria by virtue of its German language website that advertised to Austrian residents and therefore it should be subject to Austrian law.
Issue: The CJEU had to consider whether Amazon was an “establishment” in Austria under the Directive.
Analysis and holding: The CJEU held that mere accessibility of a website from a member state does not constitute the establishment of an entity in that state. Supervisory Authorities must assess whether the entity has real and effective activity, even a minimal one, exercised through stable arrangements in the member state. In this case, Amazon was not considered to be an establishment in Austria.

The GDPR does not provide a definition of “establishment” for the purpose of Article 3.
However, Recital 22 clarifies that an “[e]stablishment implies the effective and real exercise of activities through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.”
- Note: This language is incorporated from the CJEU’s 2015 Weltimmo decision.
The threshold for “stable arrangement” can actually be quite low when the centre of activities of a controller concerns the provision of services online. As a result, in some circumstances, the presence of one single employee or agent of a non-EU entity in the Union may be sufficient to constitute a stable arrangement if that employee or agent acts with a sufficient degree of stability.
The EDPB considers that, for the purpose of Article 3(1), the meaning of “processing in the context of the activities of an establishment of a controller or a processor” is to be understood in light of the relevant case law.

Data Protection Concepts