03/02/2020 CG v Facebook Ireland Ltd & Anor [2016] NICA 54 (21 December 2016) The proceedings had been fully resolved for a number of years and he requested that Google Spain be required to remove or conceal the personal data relating to him so that the reports ceased to be included in the search results. [78] Google offered its services in Spain through Google Search which was accessed through its Spanish website. Google Search was operated by Google Inc which is the parent company of the Google group and had its seat in the United States. In connection with Google Search, commercial advertising services were provided. Google Spain was established to promote the sale of advertising space. It had its seat in Madrid and acted as a commercial agent for the Google group in that member state. Google Spain was the controller in Spain of two filing systems which contained the personal data of customers who concluded contracts for advertising services with Google Inc. [79] The question for the ECJ was whether Article 4(1)(a) of Directive 95/46 was to be interpreted as meaning that the processing of personal data was carried out in the context of the activities of an establishment of the controller on the territory of a member state when the operator of a search engine set up in a member state a branch subsidiary which was intended to promote and sell advertising space offered by that engine and which orientated its activity towards the inhabitants of that member state. [80] The court noted at paragraph [48] of its judgment that recital 19 in the preamble to the Data Directive 95/46 EC stated that establishment on the territory of a member state implies the effective and real exercise of activity through stable arrangements and that the legal form of such an establishment whether simply a branch or a subsidiary with legal personality is not the determining factor. It was common case that Google Spain was engaged in the effective and real exercise of activity through stable arrangements in Spain. It was a subsidiary of Google Inc on Spanish territory and therefore an establishment within the meaning of Article 4(1)(a) of Directive 95/46. The court noted that the Directive did not require the processing of personal data to be carried out by the establishment concerned but only that it be carried out in the context of the activities of the establishment. [81] In order to ensure effective and complete protection in particular of the right to privacy those words could not be interpreted restrictively. Recitals 18 to 20 in the preamble to the Directive sought to protect individuals from being deprived of the protection guaranteed by the Directive. The court accordingly held that the processing of personal data for the purposes of a search engine such as Google Search which was operated by an undertaking that had its seat in a third state but had an establishment in the member state was carried out in the context of the activities of that establishment if the latter was intended to promote and sell in that member state advertising space offered by the search engine which served to make the service offered by that engine profitable. [82] The approach to the concept of establishment under Article 4(1)(a) in the Directive was again considered by an ECJ Chamber in Weltimmo v Nemzeti Adatvedelmi (Case C-320/14) [2016] 1 WLR 863. The data controller was registered in Slovakia and operated a website dealing with Hungarian properties. There was a complaint by advertisers using the website to the Hungarian authorities about excess charging and they imposed a fine on the data controller. The data controller appealed on the basis that it was not established in Hungary and therefore not subject to the jurisdiction of the Hungarian authorities. The issue was referred to the ECJ in order to determine the principles upon which the domestic court should act. [83] The court followed the approach in Google Spain noting that the Directive prescribed a particularly broad territorial scope, that the words “"in the context of the activities of an establishment"" should not be interpreted restrictively and that establishment on the territory of a member state implied the effective and real exercise of activity through stable arrangements. The legal form of such an establishment whether simply a branch or a subsidiary with a legal personality was not the determining factor. Accordingly in order to establish whether the data controller has an establishment in a member state other than the member state where it was registered both the degree of stability of the arrangements and the effective exercise of activities in that other member state must be interpreted in the light of the specific nature of the economic activities and the provision of www.bailii.org/nie/cases/NICA/2016/54.html 18/21