Yesterday the Administrative Court of Hamburg decided (pdf, German) that German data protection law does not apply to the data processing operations relevant for  giving Facebook users access to the social network only with their real names.

Many observers might wonder how the court came to this conclusion after the European Court of Justice widened the scope of the current European data protection law with its decisions in Google and Google Spain (C-131/12) and also interpreted the notion of “establishment” (Art. 4 para 1 lit. a of Directive 95/46/EC) in Weltimmo (C-230/14) quite broadly.

The court ruled that the business operations of Facebook in Dublin as well as those of Facebook Germany constitute an establishment within the meaning of Art. 4 para 1 Directive95/46/EC. Furthermore, the court held that if several national data protection laws might apply due to the fact that the controller is established in several Member States, the law of the Member State should apply in which the establishment with the closest connection to the disputed data processing operation is located. According to the court, that is Facebook Ireland in this specific case.

According to the court, the disputed data processing operation, however, is not carried out in the context of the activities of the German establishment in the sense of Art. 4 para 1 lit. a of Directive 95/46/EC.

The notion “carried out in the context of the activities” is to be interpreted broadly in accordance with the jurisprudence of the European Court of Justice in Google and Google Spain only if the controller is established outside the European Union, like in Google Spain. That broad interpretation of “carried out in the context of the activities” can however not be applied in the present case. Art. para 1 of Directive 95/46/EC is a conflict of law rule and determines the applicable data protection law between the laws of different Member States in case of an inner-EU situation (see also the Opinion of the Advocate General in Weltimmo, margin number 23).

With regard to the Google Spain decision, the court explains that in the present case, there might actually exist an “inextricable link” between the activities of the German and the Irish establishment. But according to the court, the reasoning of the European Court of Justice in that case cannot be applied since it concerns a conflict of jurisdictions within the European Union whereas in the Google Spain case the court in the first place wanted to give effect to European data protection law. The European Court of Justice based its decision on the argument that “it cannot be accepted that the processing of personal data carried out for the purposes of the operation of the search engine should escape the obligations and guarantees laid down by Directive 95/46” (see C-131/12, margin number 58). According to the administrative court, in the present case, the controller is established in a Member State of the European Union (Ireland). Therefore there exists no risk in the present case that natural persons affected by the contested data processing operation could be deprived of the protection offered by Directive 95/46/EC. The question in this case only was which national data protection law (within the scope of Directive 95/46/EC) would apply.

According to the court, in the case of such a conflict of data protection laws of Member States, the law of the country has to apply, in which the establishment with the closest connection of its activities to the disputed data processing operation is located. In this case: Ireland.