EU Expands Reach Of National Data Protection Regulators

The central European countries of Slovakia and Hungary are divided by a common 420-mile-long border. But that dividing line, and other European national borders, may now be a little more blurred due to a key ruling by the Court of Justice of the European Union (CJEU). The ruling, perhaps somewhat overlooked due to all of the clamor and questions surrounding the subsequent EU decision on the Safe Harbor Framework, expands the reach of national data protection regulators to companies registered in other EU member states.

The CJEU considered the issue of under what circumstances a company could be considered to have an "establishment" in a member state. Under the EU's Data Protection Directive, a member state's data protection laws are applicable to the processing of personal data where a data controller establishes activities in the territory of a member state. In a ruling issued on October 1, the CJEU held that regulators can take action against companies that are