10.4.2017

Official Journal of the European Union

C 112/22

(Case C-40/17)

(2017/C 112/32)

Language of the case: German

Referring court

Parties to the main proceedings

Applicant: Fashion ID GmbH & Co.KG

Defendant: Verbraucherzentrale NRW eV

Questions referred

1.Do the rules in Articles 22, 23 and 24 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data preclude national legislation which, in addition to the powers of intervention conferred on the data-protection authorities and the remedies available to the data subject, grants public-service associations the power to take action against the infringer in the event of an infringement in order to safeguard the interests of consumers?

If Question 1 is answered in the negative:

2.In a case such as the present one, in which someone has embedded a programming code in his website which causes the user’s browser to request content from a third party and, to this end, transmits personal data to the third party, is the person embedding the content the ‘controller’ within the meaning of Article 2(d) of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data if that person is himself unable to influence this data-processing operation?

3.If Question 2 is answered in the negative: Is Article 2(d) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data to be interpreted as meaning that it definitively regulates liability and responsibility in such a way that it precludes civil claims against a third party who, although not a ‘controller’, nonetheless creates the cause for the processing operation, without influencing it?

4.Whose ‘legitimate interests’, in a situation such as the present one, are the decisive ones in the balancing of interests to be undertaken pursuant to Article 7(f) of Directive 95/46/EC? Is it the interests in embedding third-party content or the interests of the third party?

5.To whom must the consent to be declared under Articles 7(a) and 2(h) of Directive 95/46/EC be made in a situation such as that in the present case?

6.Does the duty to inform under Article 10 of Directive 95/46/EC also apply in a situation such as that in the present case to the operator of the website who has embedded the content of a third party and thus creates the cause for the processing of personal data by the third party?

*

(1) OJ 1995 L 281, p. 31.