November

After the controversial Google Spain decision (which besides the right to be forgotten also dealt with applicable law rules), the Court of Justice of the EU (CJEU) handed down another important - and yet again rather controversial - decision on 1 October 2015. The decision on applicable data protection law, the test at law for determining which national data protection law or laws apply to processing of personal data, comes from Hungary and concerns Slovak company Weltimmo s.r.o. and the Hungarian data protection authority. The Weltimmo case addresses two important questions: What is the threshold for an establishment and how do the rules on applicable law apply to Internet companies? Which data protection authority has competence to impose sanctions? The Weltimmo judgment is potentially far-reaching and may make data protection compliance for some businesses offering services|products or otherwise operating across multiple Member States more difficult and burdensome.

On September 23, 2015, Advocate General of the European Court of Justice Yves Bot issued his Opinion in the case of Max Schrems, which is currently pending before the Court of Justice of the European Union (The CJEU). In the opinion, the Advocate General provided his views concerning two key issues related to the U.S.-EU Safe Harbor Framework: (1) the powers of national data protection authorities to investigate and suspend international data transfers made under the Safe Harbor Framework and (2) the ongoing validity of the European Commission 's Safe Harbor adequacy decision. It is yet to be seen whether the CJEU will reach the same conclusions as the Advocate General. In the interim, it is likely that this Opinion will increase the pressure on U.S. and EU government authorities to reach agreement on a revised U.S.-EU Safe Harbor Framework.

EU Commissioner, Vera Jourová, told the 37th International Privacy Conference in Amsterdam that the ECJ 's decision in the Schrems case "reaffirms once more that personal data protection is a fundamental right and that it applies also when personal data is transferred to third countries".

The Commission respects the Court's ruling and will abide by it. And so must all stakeholders!" She continued: "Too many Internet users today do not trust the Internet. Two thirds of them in the EU do not feel in complete control of their personal data. Another 42% worry that their online payments are not safe. We must always bear in mind that a strong economy and a thriving society rest primarily on one powerful human feeling, trust. This is why we launched in 2012 the data protection reform. The negotiations are now in the final stages, and I confident that a final result will be reached by the end of this year."