In a ruling handed down on 1 October last, the

The Court of Justice of the European Union has ruled on the law applicable to the controller of personal data, adopting a broader conception of the concept of establishment.

As a reminder, the controller is the natural or legal person who decides on the purpose of the processing, i.e. the objective for which personal data is collected and processed. Being a data controller in an EU Member State means complying with the legal obligations laid down by the national law of each Member State. These obligations may relate to

• the rights of the people concerned,
• reporting formalities to the national supervisory authorities (in France the CNIL)
• the transfer of processed data outside the EU.

How can the national law applicable to a data controller be determined?

Directive 95/46/EC provides that the applicable law is :

• of the territory in which the controller is established,
• if the controller is not established on the territory of a Member State, of the territory via which it uses means of processing personal data (except means for the sole purpose of transit through the territory).

What are the criteria for determining that a controller has an establishment on the territory of a Member State?

Under European law, the concept of establishment is defined as the carrying on of an actual and real activity, however minor, by means of a fixed establishment within the territory of a Member State.

In its judgment of 1 October 2015, the Court of Justice, while stating that the nationality of the data subjects of a processing operation is "irrelevant to determine the law applicable to the data controller, considered that :

• the actual and real activity of the controller may be characterised by the operation of a website in the language of a Member State " mainly, if not entirely, directed towards that Member State "
• the permanent establishment within the territory of the Member State may be characterised by the fact that ". this manager has a representative in that Member State, which is responsible for collecting debts arising from this activity and for representing it in administrative and judicial proceedings relating to the processing of the data concerned"..

What are the consequences of the inapplicability of local law for the national supervisory authority?

The Court of Justice has ruled on the extent of the prerogatives of the national supervisory authority (in France, the CNIL) whose law is not applicable:

• the supervisory authority will be able to carry out investigations but without the power to impose penalties outside the territory of its State
• the supervisory authority should cooperate with its counterpart in the Member State whose law is applicable and ask it to "to identify any infringements and impose penalties [...] where appropriate, on the basis of information [...]".

See the judgment