Weltimmo: When One Representative May Create a Local Establishment

Case C-230/14 | Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság | Court of Justice of the European Union | Third Chamber | 1 October 2015

Practice Takeaways: ① Registration is not decisive. A company may be established in a Member State other than the one in which it is formally registered. ② The threshold can be low. A real and effective activity—even a minimal one—conducted through stable arrangements may constitute an establishment. ③ One representative may be enough. For an internet business, a single local representative with sufficient stability and resources can potentially establish a local presence. ④ Look at the entire business operation.A locally directed website, local representative, bank account, postal address, and debt-collection activity may collectively demonstrate establishment. ⑤ Processing need not be performed by the establishment. It is enough that the processing occurs “in the context of” its activities. ⑥ Nationality is irrelevant. The nationality of the affected individuals does not determine which Member State’s law applies. ⑦ Authority and applicable law are distinct questions. A supervisory authority may receive and investigate a local complaint even if another Member State’s law ultimately applies, but its enforcement powers remain territorially limited.

Where is an online company established for EU data-protection purposes?

The answer is not necessarily found in its incorporation documents.

In Weltimmo, the Court of Justice of the European Union rejected a formalistic approach under which a company would be established only where it was registered. A business incorporated in one Member State could also have an establishment in another if it exercised a real and effective activity there—even a minimal one—through sufficiently stable arrangements.

The decision concerned the territorial reach of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46/EC or the Data Protection Directive) that preceded the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR.)

But “establishment” is not a concept unique to data-protection law. It is a broader concept of EU law, closely associated with the internal market and its fundamental freedoms—including the free movement of persons, goods, services, and capital. Its functional interpretation in Weltimmo, emphasizing genuine economic activity rather than legal form, remains influential under the GDPR and beyond.

Background

Weltimmo was a company registered in Slovakia that operated property-advertising websites concerning real estate located in Hungary. The websites were written in Hungarian and allowed property owners to advertise free of charge for one month. After that initial period, a fee became payable. (Judgment, para. 9.)

Several advertisers asked Weltimmo to remove both their advertisements and their personal data before fees accrued. Weltimmo did not delete the information. It invoiced the advertisers and, when they did not pay, transferred their personal data to debt-collection agencies. (Judgment, para. 9.)

The advertisers complained to the Hungarian data-protection authority. The authority concluded that Weltimmo had violated Hungarian data-protection law and imposed a fine of HUF 10 million—approximately €32,000 at the time. (Judgment, para. 10.)

Weltimmo challenged that decision. It argued that because it was established in Slovakia, the Hungarian authority could not apply Hungarian law and should instead have referred the matter to the Slovak supervisory authority. (Judgment, paras. 11–12.)

The Hungarian authority responded that Weltimmo had substantial connections with Hungary. Among other things, the company had a representative there who negotiated with advertisers, collected debts, served as a contact for complainants, and represented Weltimmo in administrative and judicial proceedings. Although Weltimmo’s internet servers were apparently located in Slovakia, Germany, or Austria—the order for reference identified all those countries as the possible location—the company’s owners lived in Hungary. Weltimmo also operated two property-listing websites written exclusively in Hungarian, maintained a Hungarian bank account, and used a Hungarian letter box for its everyday business affairs. (Judgment, paras. 13, 33.)

The Hungarian Supreme Court—the Kúria—asked the CJEU to clarify two principal issues:

1. Whether Weltimmo could be considered established in Hungary, permitting the application of Hungarian data-protection law; and
2. What powers the Hungarian supervisory authority could exercise if another Member State’s law applied.

Key Holding

The Court held that a controller may be established in a Member State other than the one in which it is formally registered when it exercises, through stable arrangements in that State, a real and effective activity—even a minimal one—in the context of which the relevant processing occurs. (Judgment, paras. 28–31, 41.)

The legal form of the local presence is not controlling. Depending on the circumstances, even one representative may constitute a sufficiently stable arrangement. The assessment must reflect the particular nature of the company’s business, especially where services are offered exclusively through the internet. (Judgment, paras. 28–30.)

By contrast, the fact that the owners of the properties forming the subject-matter of the advertisements have Hungarian nationality is of no relevance whatsoever for the purposes of determining the national law applicable to the processing.  (Judgment, para. 40.)

The Court did not definitively decide that Weltimmo had an establishment in Hungary. That factual determination remained for the national court. It held, however, that the company’s Hungarian-language websites, focus on Hungarian properties, local representative, Hungarian bank account, and local letter box were capable of establishing the required local presence. (Judgment, paras. 32–33, 39–41.)

The Court’s Analysis

1. Establishment is a functional—not formal—concept

Article 4(1)(a) of Directive 95/46 required a Member State to apply its national data-protection law where personal data were processed “in the context of the activities of an establishment” of the controller in that State.

The Court interpreted this provision in light of the Directive’s objective of ensuring effective and complete protection of individuals’ fundamental rights, particularly the right to privacy. The phrase could not be interpreted restrictively. (Judgment, paras. 24–27.)

An establishment therefore could not be identified solely by consulting a corporate registry.

Relying on Recital 19 of the Directive, the Court explained that establishment involves the real and effective exercise of an activity through stable arrangements. Whether the local operation takes the legal form of a branch, subsidiary, or separate legal entity is not determinative. (Judgment, para. 28.)

The concept instead requires a flexible, fact-specific inquiry into:

• The stability of the arrangements in the Member State;
• The actual exercise of economic activities there;
• The nature of the business and services involved; and
• The relationship between those activities and the processing at issue.

This flexibility is especially important for companies operating over the internet, whose economic presence may not resemble the conventional offices, employees, and physical infrastructure of a traditional business. (Judgment, para. 29.)

The place of incorporation is relevant—but it does not conclusively determine where a controller is established for data-protection purposes.

2. Even minimal activity may be sufficient

The Court stated that establishment extends to any real and effective activity—even a minimal one—exercised through stable arrangements. (Judgment, para. 31.)

Practice Tip: Website accessibility alone does not necessarily create an establishment. There must be genuine activity conducted through sufficiently stable arrangements. What qualifies depends on the business model: an online company may require far fewer physical and technical resources to establish a meaningful presence than a business that depends on substantial physical operations.

In Weltimmo’s case, the company operated property websites concerning Hungarian properties. The websites were written in Hungarian, and the advertisements became subject to charges after the initial free period. The Court considered these operations capable of constituting a real and effective activity in Hungary. (Judgment, para. 32.)

3. One local representative may constitute stable arrangements

A separate subsidiary, branch, or office is not required.

The Court held that the presence of a single representative may, in some circumstances, constitute a stable arrangement when that person acts with sufficient stability and has the resources necessary to provide the relevant services in the Member State. (Judgment, para. 30.)

Weltimmo’s Hungarian representative allegedly:

• Negotiated the payment of debts with advertisers;
• Served as a point of contact between Weltimmo and the complainants;
• Represented the company in administrative and judicial proceedings; and
• Maintained a stable presence in Hungary.

Those functions were not merely incidental. They were closely connected to the commercial activity that generated the disputed processing. Together with the Hungarian bank account and letter box, they could support a finding that Weltimmo maintained an establishment in Hungary. (Judgment, para. 33.)

Practice Tip: Do not assess establishment solely through corporate structure. Review local representatives, contractors, bank accounts, postal arrangements, customer relations, collections, regulatory contacts, and other operational resources connected to the relevant processing.

4. The processing need only occur “in the context of” the establishment’s activities

Finding an establishment is only the first part of the analysis. The relevant processing must also occur “in the context of the activities” of that establishment.

But the processing does not have to be technically performed by the local establishment itself. Following Google Spain, the Court emphasized that the processing need only occur in the context of the establishment’s activities. That relationship cannot be interpreted restrictively. (Judgment, paras. 34–35.)

Weltimmo’s processing included:

• Publishing personal data concerning Hungarian property owners on its websites; and
• Using those data to invoice advertisers and pursue debts after the free-advertising period ended. (Judgment, para. 36.)

Uploading personal data to a webpage constitutes processing (see, Lindqvist). Because the publication, billing, and collection operations were directly connected to Weltimmo’s Hungarian property-advertising business, the processing occurred in the context of the activity allegedly conducted through its Hungarian establishment. (Judgment, paras. 36–39.)

The server’s location—or the place where a particular technical processing operation occurred—was therefore not necessarily decisive.

5. Local targeting is evidence, but not a substitute for establishment

The fact that a service is directed toward a particular Member State can provide evidence of real and effective activity there. In Weltimmo’s case, the websites concerned Hungarian properties, were written in Hungarian, and were mainly or entirely directed toward the Hungarian market. (Judgment, paras. 32, 41.)

But targeting and establishment are distinct concepts.

The Court was unequivocal about one factor: the Hungarian nationality of the affected property owners was irrelevant to determining the applicable national law. (Judgment, para. 40.)

6. Applicable law and supervisory authority powers are separate questions

The Court drew an important distinction between:

• The law applicable to the processing; and
• The authority competent to receive a complaint and exercise supervisory powers.

Under the Directive, Article 4 determined the applicable national law, while Article 28 governed the responsibilities and powers of supervisory authorities. Those provisions performed different functions and had to be analyzed separately. (Judgment, paras. 21–23.)

• The Hungarian authority was required to hear complaints submitted by individuals who alleged that their data had been unlawfully processed in Hungary. It could examine those complaints regardless of which Member State’s law ultimately applied. (Judgment, paras. 44–45, 53–54.)
• It could also exercise investigative powers within Hungary before the applicable law had been conclusively identified. (Judgment, para. 57.)

Its power to impose a penalty, however, was more limited.

• If the Hungarian authority concluded that Slovak law applied because Weltimmo was established only in Slovakia, it could not impose a penalty under Hungarian law on a controller not established in Hungary. It would instead have to cooperate with the Slovak authority and ask that authority to determine whether Slovak law had been infringed and impose any available penalty. (Judgment, paras. 55–60.)

The Court grounded this territorial limitation in state sovereignty, legality, and the rule of law. An administrative authority cannot ordinarily exercise punitive powers beyond the legal and territorial limits imposed on it. (Judgment, para. 56; Opinion, paras. 50–61.)

Practice Tip: A supervisory authority’s ability to receive and investigate a complaint does not necessarily mean that it may apply its own substantive law or impose every remedy available under its national legal system.

The Advocate General’s Opinion

Advocate General Pedro Cruz Villalón proposed the flexible understanding of establishment that the Court largely adopted.

He explained that the concept depends upon the effective and real exercise of activity through stable arrangements, not the legal form of the local presence. Registration in one Member State therefore does not exclude the possibility that a company is also established in another. (Opinion, paras. 28–32, 36.)

For an internet-based company, the necessary human and technical resources may be modest. A single local agent may constitute stable arrangements if the agent operates with sufficient permanence and possesses the resources appropriate to the services involved. (Opinion, paras. 32–34.)

The Advocate General nevertheless cautioned against treating local targeting or the nationality of affected individuals as independent choice-of-law rules. Factors such as the Member State toward which a service is directed, the location from which data are uploaded, the nationality of the data subjects, and the residence of a company’s owners do not independently or conclusively determine the applicable law. Those considerations may provide evidence of genuine activity or of a connection between the processing and a particular establishment, but they do not replace the test established by Article 4(1)(a). (Opinion, paras. 37–42.)

On supervisory powers, the Advocate General sought to reconcile effective protection with territorial sovereignty and legality. He concluded that a local authority could receive complaints, conduct investigations, and take certain measures within its own territory even when another Member State’s substantive law applied. But findings of infringement and penalties ordinarily belonged to the authority of the Member State whose law governed the processing. (Opinion, paras. 50–66.)

The Court substantially followed that approach.

Why Weltimmo Still Matters

Weltimmo interpreted Directive 95/46, which the GDPR repealed and replaced. The Directive’s system of choosing among different national implementing laws no longer operates in the same way under a directly applicable EU regulation. The GDPR also introduced a more detailed cross-border enforcement and cooperation system, including the lead-supervisory-authority and consistency mechanisms.

But Weltimmo’s understanding of establishment remains important.

Article 3(1) GDPR applies the Regulation to processing carried out “in the context of the activities of an establishment” of a controller or processor in the Union, regardless of whether the processing itself takes place in the Union. Recital 22 likewise describes establishment as the effective and real exercise of activity through stable arrangements and confirms that legal form is not determinative.

The European Data Protection Board’s territorial-scope guidance draws upon Weltimmo when explaining that establishment must be assessed pragmatically and in light of the particular nature of the organization’s activities. The threshold may be relatively low, especially for online services, but the mere accessibility of a website in the EU does not by itself establish a sufficient presence. EDPB, Guidelines 3/2018 on the Territorial Scope of the GDPR.

The case therefore continues to offer a useful warning: a company cannot determine the territorial reach of EU data-protection law simply by selecting a place of incorporation.

What the Court Did—and Did Not—Decide

The Court did hold that establishment is a flexible and functional concept rather than a formal corporate-law classification.

It did hold that real and effective activity may be minimal, provided it is exercised through stable arrangements.

It did hold that, depending on the business model and surrounding facts, a single local representative may be sufficient.

And it did hold that processing need not be performed by the establishment itself if it occurs in the context of that establishment’s activities.

But the Court did not hold that operating a website accessible in a Member State automatically creates an establishment there.

It did not hold that targeting residents of a Member State is, by itself, sufficient to establish a local presence.

It did not definitively determine that Weltimmo was established in Hungary. It identified the relevant legal test and factual considerations but left the ultimate assessment to the referring court.

And it did not give a supervisory authority unlimited power to apply its own law or impose penalties whenever a local resident submits a complaint.

Conclusion

Weltimmo replaced a corporate-formality question with an operational one.

The question is not simply where a company is registered. It is where the company actually conducts its activities, through what people and arrangements, with what degree of stability, and how those activities relate to the processing at issue.

• For online businesses, even a modest local presence can matter. A representative, local commercial activity, a bank account, a postal address, or responsibility for customer and regulatory relationships may collectively establish a meaningful presence in a Member State.

But Weltimmo is equally important for the limits it preserves. Local targeting is not automatically establishment, nationality does not determine applicable law, and supervisory authorities remain constrained by territoriality and legality.

The enduring lesson is that establishment under EU data-protection law follows the reality of the business—not merely the address printed on its corporate documents.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-230/14, Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság.

• Court of Justice of the European Union, Third Chamber, Case C-230/14, Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság, Judgment of 1 October 2015, ECLI:EU:C:2015:639.
• Opinion of Advocate General Pedro Cruz Villalón, Case C-230/14, delivered 25 June 2015, ECLI:EU:C:2015:426.

European Data Protection Board, Guidelines 3/2018 on the Territorial Scope of the GDPR, Version 2.1, adopted 12 November 2019.

Useful reading from The de la Torre Review

• Google Spain: When Search Engines Became Responsible for Personal Data — Provides the immediate doctrinal foundation for Weltimmo. Both decisions interpret “establishment” and processing “in the context of the activities” of an establishment broadly to ensure effective data-protection rights. Read the Article.
• Lindqvist: When Publishing Personal Data Online Became Data Processing — Examines the earlier decision on which Weltimmo relied in confirming that loading personal data onto an internet page constitutes processing. Read the Article.
• Who Enforces EU Data Protection Law? Supervisory Authorities, the EDPB, and the EDPS Explained — Provides the modern GDPR framework for understanding the national supervisory authorities and the cross-border cooperation system that succeeded the Directive-era enforcement structure considered in Weltimmo. Read the Article.
• Territorial Scope of the GDPR — Provides the modern Article 3 framework for the establishment criterion examined in Weltimmo. It explains when processing occurs in the context of an EU establishment and how the GDPR applies regardless of where the processing takes place. Read the Article.