EU Privacy – Which Jurisdiction Applies?

In an opinion issued to the European Court of Justice, the Advocate General of the Court stated that according to current legislation, any data protection authority in the European Union can take action against a breach of the privacy legislation enforced by that authority, even if the entity alleged to have contravened the legislation is located in another Member State.

The opinion was given in connection with a dispute about Facebook's alleged breach of German privacy legislation. Facebook argued that since its headquarters in Ireland are responsible for its data processing activities in the European Union, Germany's privacy authorities lack jurisdiction over its actions and only the Irish data protection authorities have the power to review its activities.