{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-492-23", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-492-23)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-09", "fingerprint": "ewai:eu:af38ec", "proof": "sha256:551a6a50bb3f63ad525f495988936c557723c3f8b5efd73d227bb79595ee375d", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-492-23", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62023CJ0492", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraphs": [] }, { "title": "2 December 2025 (\n *1\n )", "paragraphs": [ "para_4", "para_5", "para_6" ] }, { "title": "X", "paragraphs": [ "para_8", "para_9", "para_10", "para_11", "para_12", "para_13", "para_14", "para_15", "para_16", "para_17", "para_18", "para_19", "para_20", "para_21", "para_22", "para_23", "para_24" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [ "para_27" ] }, { "title": "2", "paragraphs": [ "para_29" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "European Union law", "paragraphs": [] }, { "title": "Directive 2000/31", "paragraphs": [] }, { "title": "3", "paragraphs": [] }, { "title": "Recitals 14, 42, 46 and 52 of Directive 2000/31 state:", "paragraphs": [ "para_35", "para_36", "para_37" ] }, { "title": "(42)", "paragraphs": [ "para_39", "para_40" ] }, { "title": "(46)", "paragraphs": [ "para_42", "para_43" ] }, { "title": "(52)", "paragraphs": [ "para_45" ] }, { "title": "4", "paragraphs": [] }, { "title": "Article 1 of Directive 2000/31, entitled ‘Objective and scope’, provides:", "paragraphs": [ "para_48", "para_49" ] }, { "title": "5.   This Directive shall not apply to:", "paragraphs": [ "para_51", "para_52", "para_53" ] }, { "title": "5", "paragraphs": [ "para_55" ] }, { "title": "6", "paragraphs": [] }, { "title": "Article 14 of that directive, entitled ‘Hosting’, provided:", "paragraphs": [ "para_58" ] }, { "title": "(a)", "paragraphs": [ "para_60" ] }, { "title": "(b)", "paragraphs": [ "para_62", "para_63", "para_64" ] }, { "title": "7", "paragraphs": [ "para_66", "para_67", "para_68" ] }, { "title": "The GDPR", "paragraphs": [] }, { "title": "8", "paragraphs": [] }, { "title": "Recitals 4, 10, 39, 51, 74, 75, 78 and 85 of the GDPR state:", "paragraphs": [ "para_72", "para_73", "para_74" ] }, { "title": "(10)", "paragraphs": [ "para_76", "para_77" ] }, { "title": "(39)", "paragraphs": [ "para_79", "para_80" ] }, { "title": "(51)", "paragraphs": [ "para_82", "para_83" ] }, { "title": "(74)", "paragraphs": [ "para_85" ] }, { "title": "(75)", "paragraphs": [ "para_87", "para_88" ] }, { "title": "(78)", "paragraphs": [ "para_90", "para_91" ] }, { "title": "(85)", "paragraphs": [ "para_93" ] }, { "title": "9", "paragraphs": [ "para_95", "para_96" ] }, { "title": "10", "paragraphs": [] }, { "title": "Article 2 of the GDPR, entitled ‘Material scope’, provides, in paragraph 4 thereof:", "paragraphs": [ "para_99" ] }, { "title": "11", "paragraphs": [] }, { "title": "Article 4 of that regulation, entitled ‘Definitions’, reads as follows:", "paragraphs": [ "para_102" ] }, { "title": "(1)", "paragraphs": [ "para_104" ] }, { "title": "(2)", "paragraphs": [ "para_106", "para_107" ] }, { "title": "(7)", "paragraphs": [ "para_109", "para_110" ] }, { "title": "(11)", "paragraphs": [ "para_112", "para_113" ] }, { "title": "12", "paragraphs": [ "para_115" ] }, { "title": "13", "paragraphs": [ "para_117", "para_118" ] }, { "title": "(a)", "paragraphs": [ "para_120" ] }, { "title": "(b)", "paragraphs": [ "para_122", "para_123" ] }, { "title": "(d)", "paragraphs": [ "para_125", "para_126" ] }, { "title": "(f)", "paragraphs": [ "para_128", "para_129" ] }, { "title": "14", "paragraphs": [ "para_131", "para_132" ] }, { "title": "(a)", "paragraphs": [ "para_134" ] }, { "title": "(b)", "paragraphs": [ "para_136" ] }, { "title": "(c)", "paragraphs": [ "para_138" ] }, { "title": "(d)", "paragraphs": [ "para_140" ] }, { "title": "(e)", "paragraphs": [ "para_142" ] }, { "title": "(f)", "paragraphs": [ "para_144" ] }, { "title": "15", "paragraphs": [ "para_146", "para_147" ] }, { "title": "16", "paragraphs": [ "para_149", "para_150" ] }, { "title": "2.   Paragraph 1 shall not apply if one of the following applies:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_153", "para_154" ] }, { "title": "17", "paragraphs": [ "para_156", "para_157" ] }, { "title": "(a)", "paragraphs": [ "para_159" ] }, { "title": "18", "paragraphs": [ "para_161", "para_162" ] }, { "title": "(a)", "paragraphs": [ "para_164" ] }, { "title": "19", "paragraphs": [ "para_166", "para_167", "para_168" ] }, { "title": "(d) the personal data have been unlawfully processed;", "paragraphs": [ "para_170", "para_171" ] }, { "title": "20", "paragraphs": [ "para_173" ] }, { "title": "21", "paragraphs": [ "para_175", "para_176" ] }, { "title": "22", "paragraphs": [ "para_178", "para_179", "para_180" ] }, { "title": "23", "paragraphs": [] }, { "title": "Article 26 of the GDPR, entitled ‘Joint controllers’, states, in paragraph 1 thereof:", "paragraphs": [ "para_183" ] }, { "title": "24", "paragraphs": [] }, { "title": "Under Article 32 of the GDPR, entitled ‘Security of processing’:", "paragraphs": [ "para_186" ] }, { "title": "(a)", "paragraphs": [ "para_188" ] }, { "title": "(b)", "paragraphs": [ "para_190" ] }, { "title": "(c)", "paragraphs": [ "para_192" ] }, { "title": "(d)", "paragraphs": [ "para_194", "para_195", "para_196", "para_197" ] }, { "title": "25", "paragraphs": [ "para_199", "para_200", "para_201", "para_202" ] }, { "title": "26", "paragraphs": [] }, { "title": "Article 94 of the GDPR provides:", "paragraphs": [ "para_205", "para_206" ] }, { "title": "Romanian law", "paragraphs": [] }, { "title": "27", "paragraphs": [ "para_209", "para_210", "para_211", "para_212" ] }, { "title": "28", "paragraphs": [ "para_214", "para_215" ] }, { "title": "(a)", "paragraphs": [ "para_217" ] }, { "title": "(b)", "paragraphs": [ "para_219", "para_220", "para_221" ] }, { "title": "29", "paragraphs": [ "para_223", "para_224" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "30", "paragraphs": [ "para_227" ] }, { "title": "31", "paragraphs": [ "para_229" ] }, { "title": "32", "paragraphs": [ "para_231" ] }, { "title": "33", "paragraphs": [ "para_233" ] }, { "title": "34", "paragraphs": [ "para_235" ] }, { "title": "35", "paragraphs": [ "para_237" ] }, { "title": "36", "paragraphs": [ "para_239" ] }, { "title": "37", "paragraphs": [ "para_241" ] }, { "title": "38", "paragraphs": [ "para_243" ] }, { "title": "39", "paragraphs": [ "para_245" ] }, { "title": "40", "paragraphs": [ "para_247" ] }, { "title": "41", "paragraphs": [ "para_249" ] }, { "title": "42", "paragraphs": [ "para_251" ] }, { "title": "43", "paragraphs": [ "para_253", "para_254", "para_255", "para_256", "para_257" ] }, { "title": "Consideration of the questions referred", "paragraphs": [] }, { "title": "44", "paragraphs": [ "para_260" ] }, { "title": "45", "paragraphs": [ "para_262" ] }, { "title": "46", "paragraphs": [ "para_264" ] }, { "title": "The second to fourth questions, concerning the interpretation of the GDPR", "paragraphs": [] }, { "title": "Preliminary remarks", "paragraphs": [] }, { "title": "47", "paragraphs": [ "para_268" ] }, { "title": "48", "paragraphs": [ "para_270" ] }, { "title": "49", "paragraphs": [ "para_272" ] }, { "title": "50", "paragraphs": [ "para_274" ] }, { "title": "51", "paragraphs": [ "para_276" ] }, { "title": "52", "paragraphs": [ "para_278" ] }, { "title": "53", "paragraphs": [ "para_280" ] }, { "title": "54", "paragraphs": [ "para_282" ] }, { "title": "55", "paragraphs": [ "para_284" ] }, { "title": "56", "paragraphs": [ "para_286" ] }, { "title": "57", "paragraphs": [ "para_288" ] }, { "title": "58", "paragraphs": [ "para_290" ] }, { "title": "59", "paragraphs": [ "para_292" ] }, { "title": "60", "paragraphs": [ "para_294" ] }, { "title": "61", "paragraphs": [ "para_296" ] }, { "title": "62", "paragraphs": [ "para_298" ] }, { "title": "63", "paragraphs": [ "para_300" ] }, { "title": "64", "paragraphs": [ "para_302" ] }, { "title": "65", "paragraphs": [ "para_304" ] }, { "title": "66", "paragraphs": [ "para_306" ] }, { "title": "67", "paragraphs": [ "para_308" ] }, { "title": "68", "paragraphs": [ "para_310" ] }, { "title": "69", "paragraphs": [ "para_312" ] }, { "title": "70", "paragraphs": [ "para_314" ] }, { "title": "71", "paragraphs": [ "para_316" ] }, { "title": "72", "paragraphs": [ "para_318" ] }, { "title": "73", "paragraphs": [ "para_320" ] }, { "title": "74", "paragraphs": [ "para_322" ] }, { "title": "75", "paragraphs": [ "para_324" ] }, { "title": "76", "paragraphs": [ "para_326" ] }, { "title": "The second and third questions", "paragraphs": [] }, { "title": "77", "paragraphs": [ "para_329" ] }, { "title": "78", "paragraphs": [ "para_331" ] }, { "title": "79", "paragraphs": [ "para_333" ] }, { "title": "80", "paragraphs": [ "para_335" ] }, { "title": "81", "paragraphs": [ "para_337" ] }, { "title": "82", "paragraphs": [ "para_339" ] }, { "title": "83", "paragraphs": [ "para_341" ] }, { "title": "84", "paragraphs": [ "para_343" ] }, { "title": "85", "paragraphs": [ "para_345" ] }, { "title": "86", "paragraphs": [ "para_347" ] }, { "title": "87", "paragraphs": [ "para_349" ] }, { "title": "88", "paragraphs": [ "para_351" ] }, { "title": "89", "paragraphs": [ "para_353" ] }, { "title": "90", "paragraphs": [ "para_355" ] }, { "title": "91", "paragraphs": [ "para_357" ] }, { "title": "92", "paragraphs": [ "para_359" ] }, { "title": "93", "paragraphs": [ "para_361" ] }, { "title": "94", "paragraphs": [ "para_363" ] }, { "title": "95", "paragraphs": [ "para_365" ] }, { "title": "96", "paragraphs": [ "para_367" ] }, { "title": "97", "paragraphs": [ "para_369" ] }, { "title": "98", "paragraphs": [ "para_371" ] }, { "title": "99", "paragraphs": [ "para_373" ] }, { "title": "100", "paragraphs": [ "para_375" ] }, { "title": "101", "paragraphs": [ "para_377" ] }, { "title": "102", "paragraphs": [ "para_379" ] }, { "title": "103", "paragraphs": [ "para_381" ] }, { "title": "104", "paragraphs": [ "para_383" ] }, { "title": "105", "paragraphs": [ "para_385" ] }, { "title": "106", "paragraphs": [ "para_387", "para_388", "para_389", "para_390", "para_391", "para_392", "para_393" ] }, { "title": "The fourth question", "paragraphs": [] }, { "title": "107", "paragraphs": [ "para_396" ] }, { "title": "108", "paragraphs": [ "para_398" ] }, { "title": "109", "paragraphs": [ "para_400" ] }, { "title": "110", "paragraphs": [ "para_402" ] }, { "title": "111", "paragraphs": [ "para_404" ] }, { "title": "112", "paragraphs": [ "para_406" ] }, { "title": "113", "paragraphs": [ "para_408" ] }, { "title": "114", "paragraphs": [ "para_410" ] }, { "title": "115", "paragraphs": [ "para_412" ] }, { "title": "116", "paragraphs": [ "para_414" ] }, { "title": "117", "paragraphs": [ "para_416" ] }, { "title": "118", "paragraphs": [ "para_418" ] }, { "title": "119", "paragraphs": [ "para_420" ] }, { "title": "120", "paragraphs": [ "para_422" ] }, { "title": "121", "paragraphs": [ "para_424" ] }, { "title": "122", "paragraphs": [ "para_426" ] }, { "title": "123", "paragraphs": [ "para_428" ] }, { "title": "124", "paragraphs": [ "para_430" ] }, { "title": "125", "paragraphs": [ "para_432" ] }, { "title": "126", "paragraphs": [ "para_434" ] }, { "title": "First question, concerning the interpretation of Directive 2000/31", "paragraphs": [] }, { "title": "127", "paragraphs": [ "para_437" ] }, { "title": "128", "paragraphs": [ "para_439" ] }, { "title": "129", "paragraphs": [ "para_441" ] }, { "title": "130", "paragraphs": [ "para_443" ] }, { "title": "131", "paragraphs": [ "para_445" ] }, { "title": "132", "paragraphs": [ "para_447" ] }, { "title": "133", "paragraphs": [ "para_449" ] }, { "title": "134", "paragraphs": [ "para_451" ] }, { "title": "135", "paragraphs": [ "para_453" ] }, { "title": "136", "paragraphs": [ "para_455" ] }, { "title": "Costs", "paragraphs": [] }, { "title": "137", "paragraphs": [ "para_458" ] }, { "title": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraphs": [ "para_460", "para_461", "para_462", "para_463", "para_464", "para_465", "para_466", "para_467", "para_468", "para_469" ] }, { "title": "Article 32 of Regulation 2016/679", "paragraphs": [ "para_471", "para_472", "para_473", "para_474", "para_475" ] }, { "title": "(\n *1\n ) Language of the case: Romanian", "paragraphs": [] } ], "paragraphs": [ { "text": "62023CJ0492", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraph_id": "para_2" }, { "text": "2 December 2025 (\n *1\n )", "paragraph_id": "para_3" }, { "text": "(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user ad …", "paragraph_id": "para_4" }, { "text": "In Case C‑492/23,", "paragraph_id": "para_5" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Curtea de Apel Cluj (Court of Appeal, Cluj, Romania), made by decision of 15 June 2023, received at the Court on 3 August 2023, in the proceedings", "paragraph_id": "para_6" }, { "text": "X", "paragraph_id": "para_7" }, { "text": "v", "paragraph_id": "para_8" }, { "text": "Russmedia Digital SRL,", "paragraph_id": "para_9" }, { "text": "Inform Media Press SRL,", "paragraph_id": "para_10" }, { "text": "THE COURT (Grand Chamber),", "paragraph_id": "para_11" }, { "text": "composed of K. Lenaerts, President, T. von Danwitz, Vice-President, F. Biltgen, K. Jürimäe (Rapporteur), C. Lycourgos, I. Jarukaitis, M.L. Arastey Sahún, I. Ziemele, J. Passer, Presidents of Chambers, S. Rodin, E. Regan, N. Jääskinen and D. Gratsias, Judges,", "paragraph_id": "para_12" }, { "text": "Advocate General: M. Szpunar,", "paragraph_id": "para_13" }, { "text": "Registrar: R. Şereş, Administrator,", "paragraph_id": "para_14" }, { "text": "having regard to the written procedure and further to the hearing on 2 July 2024,", "paragraph_id": "para_15" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_16" }, { "text": "–", "paragraph_id": "para_17" }, { "text": "X, by I. Kis, avocată,", "paragraph_id": "para_18" }, { "text": "–", "paragraph_id": "para_19" }, { "text": "the Romanian Government, by E. Gane, L. Ghiţă and R.I. Haţieganu, acting as Agents,", "paragraph_id": "para_20" }, { "text": "–", "paragraph_id": "para_21" }, { "text": "the European Commission, by L. Armati, H. Kranenborg, P.‑J. Loewenthal and L. Nicolae, acting as Agents,", "paragraph_id": "para_22" }, { "text": "after hearing the Opinion of the Advocate General at the sitting on 6 February 2025,", "paragraph_id": "para_23" }, { "text": "gives the following", "paragraph_id": "para_24" }, { "text": "Judgment", "paragraph_id": "para_25" }, { "text": "1", "paragraph_id": "para_26" }, { "text": "This request for a preliminary ruling concerns the interpretation of Articles 12 to 15 of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive …", "paragraph_id": "para_27" }, { "text": "2", "paragraph_id": "para_28" }, { "text": "The request has been made in proceedings between a natural person, X, on the one hand, and Russmedia Digital SRL and Inform Media Press SRL (together, ‘Russmedia’), on the other, concerning an action for compensation for the non-material damage allegedly sustained by the applicant in the main proceedings as a result of the unlawful processing of her personal data and the infringement of her right of personal portrayal, right to honour and right to privacy.", "paragraph_id": "para_29" }, { "text": "Legal context", "paragraph_id": "para_30" }, { "text": "European Union law", "paragraph_id": "para_31" }, { "text": "Directive 2000/31", "paragraph_id": "para_32" }, { "text": "3", "paragraph_id": "para_33" }, { "text": "Recitals 14, 42, 46 and 52 of Directive 2000/31 state:", "paragraph_id": "para_34" }, { "text": "‘(14)", "paragraph_id": "para_35" }, { "text": "The protection of individuals with regard to the processing of personal data is solely governed by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data …", "paragraph_id": "para_36" }, { "text": "…", "paragraph_id": "para_37" }, { "text": "(42)", "paragraph_id": "para_38" }, { "text": "The exemptions from liability established in this Directive cover only cases where the activity of the information society service provider is limited to the technical process of operating and giving access to a communication network over which information made available by third parties is transmit …", "paragraph_id": "para_39" }, { "text": "…", "paragraph_id": "para_40" }, { "text": "(46)", "paragraph_id": "para_41" }, { "text": "In order to benefit from a limitation of liability, the provider of an information society service, consisting of the storage of information, upon obtaining actual knowledge or awareness of illegal activities has to act expeditiously to remove or to disable access to the information concerned; the r …", "paragraph_id": "para_42" }, { "text": "…", "paragraph_id": "para_43" }, { "text": "(52)", "paragraph_id": "para_44" }, { "text": "… damage which may arise in connection with information society services is characterised both by its rapidity and by its geographical extent; in view of this specific character and the need to ensure that national authorities do not endanger the mutual confidence which they should have in one another, this Directive requests Member States to ensure that appropriate court actions are available; …’", "paragraph_id": "para_45" }, { "text": "4", "paragraph_id": "para_46" }, { "text": "Article 1 of Directive 2000/31, entitled ‘Objective and scope’, provides:", "paragraph_id": "para_47" }, { "text": "‘1.   This Directive seeks to contribute to the proper functioning of the internal market by ensuring the free movement of information society services between the Member States.", "paragraph_id": "para_48" }, { "text": "…", "paragraph_id": "para_49" }, { "text": "5.   This Directive shall not apply to:", "paragraph_id": "para_50" }, { "text": "…", "paragraph_id": "para_51" }, { "text": "(b) questions relating to information society services covered by Directives [95/46] and [97/66];", "paragraph_id": "para_52" }, { "text": "…’", "paragraph_id": "para_53" }, { "text": "5", "paragraph_id": "para_54" }, { "text": "Section 4 of Chapter II of Directive 2000/31, entitled ‘Liability of intermediary service providers’, included, in the version applicable to the main proceedings, Articles 12 to 15 of that directive. Articles 12 and 13 of Directive 2000/31 concerned, in accordance with their respective titles, ‘Mere conduit’ and ‘Caching’.", "paragraph_id": "para_55" }, { "text": "6", "paragraph_id": "para_56" }, { "text": "Article 14 of that directive, entitled ‘Hosting’, provided:", "paragraph_id": "para_57" }, { "text": "‘1.   Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:", "paragraph_id": "para_58" }, { "text": "(a)", "paragraph_id": "para_59" }, { "text": "the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or", "paragraph_id": "para_60" }, { "text": "(b)", "paragraph_id": "para_61" }, { "text": "the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.", "paragraph_id": "para_62" }, { "text": "2.   Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.", "paragraph_id": "para_63" }, { "text": "3.   This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States’ legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.’", "paragraph_id": "para_64" }, { "text": "7", "paragraph_id": "para_65" }, { "text": "Article 15 of Directive 2000/31, entitled ‘No general obligation to monitor’, provided, in paragraphs 1 and 2:", "paragraph_id": "para_66" }, { "text": "‘1.   Member States shall not impose a general obligation on providers, when providing the services covered by Articles 12, 13 and 14, to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.", "paragraph_id": "para_67" }, { "text": "2.   Member States may establish obligations for information society service providers promptly to inform the competent public authorities of alleged illegal activities undertaken or information provided by recipients of their service or obligations to communicate to the competent authorities, at their request, information enabling the identification of recipients of their service with whom they have storage agreements.’", "paragraph_id": "para_68" }, { "text": "The GDPR", "paragraph_id": "para_69" }, { "text": "8", "paragraph_id": "para_70" }, { "text": "Recitals 4, 10, 39, 51, 74, 75, 78 and 85 of the GDPR state:", "paragraph_id": "para_71" }, { "text": "‘(4)", "paragraph_id": "para_72" }, { "text": "The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionali …", "paragraph_id": "para_73" }, { "text": "…", "paragraph_id": "para_74" }, { "text": "(10)", "paragraph_id": "para_75" }, { "text": "In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in …", "paragraph_id": "para_76" }, { "text": "…", "paragraph_id": "para_77" }, { "text": "(39)", "paragraph_id": "para_78" }, { "text": "Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that a …", "paragraph_id": "para_79" }, { "text": "…", "paragraph_id": "para_80" }, { "text": "(51)", "paragraph_id": "para_81" }, { "text": "Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … Such personal data should not be processed, unless pro …", "paragraph_id": "para_82" }, { "text": "…", "paragraph_id": "para_83" }, { "text": "(74)", "paragraph_id": "para_84" }, { "text": "The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller’s behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the com …", "paragraph_id": "para_85" }, { "text": "(75)", "paragraph_id": "para_86" }, { "text": "The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to … identity theft or fraud … damage to the reputation … where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; …", "paragraph_id": "para_87" }, { "text": "…", "paragraph_id": "para_88" }, { "text": "(78)", "paragraph_id": "para_89" }, { "text": "The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. …", "paragraph_id": "para_90" }, { "text": "…", "paragraph_id": "para_91" }, { "text": "(85)", "paragraph_id": "para_92" }, { "text": "A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, … damage to reputation …’", "paragraph_id": "para_93" }, { "text": "9", "paragraph_id": "para_94" }, { "text": "Article 1 of that regulation, entitled ‘Subject-matter and objectives’, provides, in paragraph 2 thereof:", "paragraph_id": "para_95" }, { "text": "‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’", "paragraph_id": "para_96" }, { "text": "10", "paragraph_id": "para_97" }, { "text": "Article 2 of the GDPR, entitled ‘Material scope’, provides, in paragraph 4 thereof:", "paragraph_id": "para_98" }, { "text": "‘This Regulation shall be without prejudice to the application of Directive [2000/31], in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.’", "paragraph_id": "para_99" }, { "text": "11", "paragraph_id": "para_100" }, { "text": "Article 4 of that regulation, entitled ‘Definitions’, reads as follows:", "paragraph_id": "para_101" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_102" }, { "text": "(1)", "paragraph_id": "para_103" }, { "text": "“personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;", "paragraph_id": "para_104" }, { "text": "(2)", "paragraph_id": "para_105" }, { "text": "“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;", "paragraph_id": "para_106" }, { "text": "…", "paragraph_id": "para_107" }, { "text": "(7)", "paragraph_id": "para_108" }, { "text": "“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;", "paragraph_id": "para_109" }, { "text": "…", "paragraph_id": "para_110" }, { "text": "(11)", "paragraph_id": "para_111" }, { "text": "“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;", "paragraph_id": "para_112" }, { "text": "…’", "paragraph_id": "para_113" }, { "text": "12", "paragraph_id": "para_114" }, { "text": "Chapter II of the GDPR, entitled ‘Principles’, comprises, inter alia, Articles 5 to 9 of that regulation.", "paragraph_id": "para_115" }, { "text": "13", "paragraph_id": "para_116" }, { "text": "Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides:", "paragraph_id": "para_117" }, { "text": "‘1.   Personal data shall be:", "paragraph_id": "para_118" }, { "text": "(a)", "paragraph_id": "para_119" }, { "text": "processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);", "paragraph_id": "para_120" }, { "text": "(b)", "paragraph_id": "para_121" }, { "text": "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes … (“purpose limitation”);", "paragraph_id": "para_122" }, { "text": "…", "paragraph_id": "para_123" }, { "text": "(d)", "paragraph_id": "para_124" }, { "text": "accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);", "paragraph_id": "para_125" }, { "text": "…", "paragraph_id": "para_126" }, { "text": "(f)", "paragraph_id": "para_127" }, { "text": "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).", "paragraph_id": "para_128" }, { "text": "2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’", "paragraph_id": "para_129" }, { "text": "14", "paragraph_id": "para_130" }, { "text": "Article 6 of that regulation, entitled ‘Lawfulness of processing’, provides, in the first subparagraph of paragraph 1 thereof:", "paragraph_id": "para_131" }, { "text": "‘Processing shall be lawful only if and to the extent that at least one of the following applies:", "paragraph_id": "para_132" }, { "text": "(a)", "paragraph_id": "para_133" }, { "text": "the data subject has given consent to the processing of his or her personal data for one or more specific purposes;", "paragraph_id": "para_134" }, { "text": "(b)", "paragraph_id": "para_135" }, { "text": "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;", "paragraph_id": "para_136" }, { "text": "(c)", "paragraph_id": "para_137" }, { "text": "processing is necessary for compliance with a legal obligation to which the controller is subject;", "paragraph_id": "para_138" }, { "text": "(d)", "paragraph_id": "para_139" }, { "text": "processing is necessary in order to protect the vital interests of the data subject or of another natural person;", "paragraph_id": "para_140" }, { "text": "(e)", "paragraph_id": "para_141" }, { "text": "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;", "paragraph_id": "para_142" }, { "text": "(f)", "paragraph_id": "para_143" }, { "text": "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’", "paragraph_id": "para_144" }, { "text": "15", "paragraph_id": "para_145" }, { "text": "Article 7 of the GDPR, entitled ‘Conditions for consent’, provides, in paragraph 1 thereof:", "paragraph_id": "para_146" }, { "text": "‘Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.’", "paragraph_id": "para_147" }, { "text": "16", "paragraph_id": "para_148" }, { "text": "Article 9 of the GDPR, entitled ‘Processing of special categories of personal data’, provides:", "paragraph_id": "para_149" }, { "text": "‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.", "paragraph_id": "para_150" }, { "text": "2.   Paragraph 1 shall not apply if one of the following applies:", "paragraph_id": "para_151" }, { "text": "(a)", "paragraph_id": "para_152" }, { "text": "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;", "paragraph_id": "para_153" }, { "text": "…’", "paragraph_id": "para_154" }, { "text": "17", "paragraph_id": "para_155" }, { "text": "Article 13 of the GDPR, entitled ‘Information to be provided where personal data are collected from the data subject’, provides, in paragraph 1(a) thereof:", "paragraph_id": "para_156" }, { "text": "‘Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:", "paragraph_id": "para_157" }, { "text": "(a)", "paragraph_id": "para_158" }, { "text": "the identity and the contact details of the controller and, where applicable, of the controller’s representative’.", "paragraph_id": "para_159" }, { "text": "18", "paragraph_id": "para_160" }, { "text": "Article 14 of that regulation, entitled ‘Information to be provided where personal data have not been obtained from the data subject’, provides in paragraph 1(a) thereof:", "paragraph_id": "para_161" }, { "text": "‘Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:", "paragraph_id": "para_162" }, { "text": "(a)", "paragraph_id": "para_163" }, { "text": "the identity and the contact details of the controller and, where applicable, of the controller’s representative’.", "paragraph_id": "para_164" }, { "text": "19", "paragraph_id": "para_165" }, { "text": "In Chapter III of the GDPR, entitled ‘Rights of the data subject’, Article 17 of that regulation, itself entitled ‘Right to erasure (“right to be forgotten”)’, provides in paragraphs 1 and 2 thereof:", "paragraph_id": "para_166" }, { "text": "‘1.   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:", "paragraph_id": "para_167" }, { "text": "…", "paragraph_id": "para_168" }, { "text": "(d) the personal data have been unlawfully processed;", "paragraph_id": "para_169" }, { "text": "…", "paragraph_id": "para_170" }, { "text": "2.   Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.’", "paragraph_id": "para_171" }, { "text": "20", "paragraph_id": "para_172" }, { "text": "Chapter IV of the GDPR, entitled ‘Controller and processor’, includes, in Section 1, itself entitled ‘General obligations’, inter alia, Articles 24 to 26 thereof.", "paragraph_id": "para_173" }, { "text": "21", "paragraph_id": "para_174" }, { "text": "Article 24 of that regulation, entitled ‘Responsibility of the controller’, provides, in paragraph 1 thereof:", "paragraph_id": "para_175" }, { "text": "‘Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.’", "paragraph_id": "para_176" }, { "text": "22", "paragraph_id": "para_177" }, { "text": "Article 25 of that regulation, entitled ‘Data protection by design and by default’ provides, in paragraphs 1 and 2 thereof:", "paragraph_id": "para_178" }, { "text": "‘1.   Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of t …", "paragraph_id": "para_179" }, { "text": "2.   The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their …", "paragraph_id": "para_180" }, { "text": "23", "paragraph_id": "para_181" }, { "text": "Article 26 of the GDPR, entitled ‘Joint controllers’, states, in paragraph 1 thereof:", "paragraph_id": "para_182" }, { "text": "‘Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of …", "paragraph_id": "para_183" }, { "text": "24", "paragraph_id": "para_184" }, { "text": "Under Article 32 of the GDPR, entitled ‘Security of processing’:", "paragraph_id": "para_185" }, { "text": "‘1.   Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:", "paragraph_id": "para_186" }, { "text": "(a)", "paragraph_id": "para_187" }, { "text": "the pseudonymisation and encryption of personal data;", "paragraph_id": "para_188" }, { "text": "(b)", "paragraph_id": "para_189" }, { "text": "the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;", "paragraph_id": "para_190" }, { "text": "(c)", "paragraph_id": "para_191" }, { "text": "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;", "paragraph_id": "para_192" }, { "text": "(d)", "paragraph_id": "para_193" }, { "text": "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.", "paragraph_id": "para_194" }, { "text": "2.   In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.", "paragraph_id": "para_195" }, { "text": "3.   Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.", "paragraph_id": "para_196" }, { "text": "4.   The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.’", "paragraph_id": "para_197" }, { "text": "25", "paragraph_id": "para_198" }, { "text": "Article 82 of that regulation, entitled ‘Right to compensation and liability’, states, in paragraphs 1 to 3 thereof:", "paragraph_id": "para_199" }, { "text": "‘1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.", "paragraph_id": "para_200" }, { "text": "2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.", "paragraph_id": "para_201" }, { "text": "3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.’", "paragraph_id": "para_202" }, { "text": "26", "paragraph_id": "para_203" }, { "text": "Article 94 of the GDPR provides:", "paragraph_id": "para_204" }, { "text": "‘1.   Directive [95/46] is repealed with effect from 25 May 2018.", "paragraph_id": "para_205" }, { "text": "2.   References to the repealed Directive shall be construed as references to this Regulation. …’", "paragraph_id": "para_206" }, { "text": "Romanian law", "paragraph_id": "para_207" }, { "text": "27", "paragraph_id": "para_208" }, { "text": "Article 11 of Legea nr. 365/2002 privind comerțul electronic (Law No 365/2002 on electronic commerce) of 7 June 2002 ( Monitorul Oficial al României , Part I, No 483 of 5 July 2002), as amended by Legea nr. 121/2006 pentru modificarea și completarea Legii nr. 365/2002 privind comerțul electronic (La …", "paragraph_id": "para_209" }, { "text": "‘1.   Service providers shall be subject to the legal provisions governing civil and criminal liability and liability for administrative offences, unless otherwise provided for in this law.", "paragraph_id": "para_210" }, { "text": "2.   Service providers shall be liable for information supplied by them or on their behalf.", "paragraph_id": "para_211" }, { "text": "3.   Service providers shall not be liable for information transmitted or stored or to which they provide access under the conditions laid down in Articles 12 to 15.’", "paragraph_id": "para_212" }, { "text": "28", "paragraph_id": "para_213" }, { "text": "Article 14 of Law No 365/2002, entitled ‘Permanent storage of information, hosting’, provides:", "paragraph_id": "para_214" }, { "text": "‘1.   Where an information society service consists of the storage of information provided by a recipient of that service, the provider of that service shall not be liable for the information stored at the request of a recipient if either of the following conditions is met:", "paragraph_id": "para_215" }, { "text": "(a)", "paragraph_id": "para_216" }, { "text": "the service provider is not aware of the illegal nature of the activity or of the information stored and, as regards claims for damages, is not aware of facts or circumstances from which it would follow that the activity or information in question could infringe the rights of a third party;", "paragraph_id": "para_217" }, { "text": "(b)", "paragraph_id": "para_218" }, { "text": "if the service provider becomes aware of the illegal nature of the activity or information concerned or of facts or circumstances from which it would follow that the activity or information in question could infringe the rights of a third party, the service provider acts expeditiously to remove it or to block access to it.", "paragraph_id": "para_219" }, { "text": "2.   The provisions of paragraph 1 shall not apply where the recipient is acting under the authority or the control of the service provider.", "paragraph_id": "para_220" }, { "text": "3.   The provisions of this article shall not affect the right of a judicial or administrative authority to require that the service provider terminate or prevent a data breach, and shall not affect the right to establish government procedures to restrict or terminate access to information.’", "paragraph_id": "para_221" }, { "text": "29", "paragraph_id": "para_222" }, { "text": "The Normele metodologice pentru aplicarea Legii nr. 365/2002 privind comerţul electronic (implementing rules for Law No 365/2002 on electronic commerce), approved by Hotărârea Guvernului nr. 1.308 privind aprobarea Normelor metodologice pentru aplicarea Legii nr. 365/2002 privind comerţul electronic …", "paragraph_id": "para_223" }, { "text": "‘Information society service providers that offer the services referred to in Articles 12 to 15 of Law [No 365/2002] are not required to monitor the information which they transmit or store, nor are they required actively to seek data on activities or information having the appearance of unlawful activity in the sector of the information society services that they supply.’", "paragraph_id": "para_224" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_225" }, { "text": "30", "paragraph_id": "para_226" }, { "text": "Russmedia Digital, a company incorporated under Romanian law, is the owner of the website www.publi24.ro, an online marketplace on which advertisements for, inter alia, the sale of goods or the provision of services in Romania can be published either free of charge or for a fee.", "paragraph_id": "para_227" }, { "text": "31", "paragraph_id": "para_228" }, { "text": "The applicant in the main proceedings claims that, on 1 August 2018, an unidentified third party published on that website an untrue and harmful advertisement presenting her as offering sexual services. That advertisement contained photographs of that applicant, which had been used without her conse …", "paragraph_id": "para_229" }, { "text": "32", "paragraph_id": "para_230" }, { "text": "Taking the view that the advertisement at issue in the main proceedings infringed her right of personal portrayal, and rights to honour, reputation and privacy, as well as the rules relating to the processing of personal data, the applicant in the main proceedings brought an action against Russmedia …", "paragraph_id": "para_231" }, { "text": "33", "paragraph_id": "para_232" }, { "text": "Russmedia appealed against that judgment. The Tribunalul Specializat Cluj (Specialised Court, Cluj, Romania) upheld that appeal, holding that the action brought by the applicant in the main proceedings was unfounded, since the advertisement at issue in the main proceedings did not originate from Rus …", "paragraph_id": "para_233" }, { "text": "34", "paragraph_id": "para_234" }, { "text": "That applicant brought an appeal against that judgment before the Curtea de Apel Cluj (Court of Appeal, Cluj, Romania), arguing that the Tribunalul Specializat Cluj (Specialised Court, Cluj) had relied on a misinterpretation of Law No 365/2002. She submits, inter alia, that since that law was not le …", "paragraph_id": "para_235" }, { "text": "35", "paragraph_id": "para_236" }, { "text": "Furthermore, the applicant in the main proceedings submits that the exemption from liability of such a provider does not apply if liability is established under other regulatory acts, such as the GDPR. In her view, Russmedia published her personal data without her consent and, through the operation …", "paragraph_id": "para_237" }, { "text": "36", "paragraph_id": "para_238" }, { "text": "Russmedia contends, for its part, that the solution adopted by the Tribunalul Specializat Cluj (Specialised Court, Cluj) is correct. In Russmedia’s view, the applicant in the main proceedings has not shown how the GDPR constituted a special rule which prevents the application of the relevant provisions of Law No 365/2002.", "paragraph_id": "para_239" }, { "text": "37", "paragraph_id": "para_240" }, { "text": "The Curtea de Apel Cluj (Court of Appeal, Cluj), which is the referring court and rules in the present case as an appellate court whose decision is final, considers it necessary to determine, in particular, the limits of the exemption from liability of an information society services provider, such as Russmedia, under Directive 2000/31.", "paragraph_id": "para_241" }, { "text": "38", "paragraph_id": "para_242" }, { "text": "Making reference to the relevant case-law of the Court of Justice, the referring court states that although, in accordance with that case-law, there is no obligation for operators of online marketplaces to carry out prior verification of the information or advertisements posted by user advertisers, …", "paragraph_id": "para_243" }, { "text": "39", "paragraph_id": "para_244" }, { "text": "The referring court emphasises, however, that that case-law refers only to offers posted on a website that were held to be illegal because of an analysis of facts and circumstances explicitly communicated to the data controller after the advertisement in question had been published. Thus, the Court …", "paragraph_id": "para_245" }, { "text": "40", "paragraph_id": "para_246" }, { "text": "The referring court raises the question, in that context, of whether it is necessary for a platform to receive a notification in order to be obliged to erase manifestly unlawful and seriously harmful content. In the present case, the advertisement at issue in the main proceedings was published without verification of the identity of the user advertiser and clearly without the consent of the applicant in the main proceedings having been obtained.", "paragraph_id": "para_247" }, { "text": "41", "paragraph_id": "para_248" }, { "text": "Moreover, although the advertisement at issue in the main proceedings was deleted from the original website following a notification from the applicant, the content of that advertisement, including her contact details and photographs, was, it is stated, reproduced in its entirety on numerous other w …", "paragraph_id": "para_249" }, { "text": "42", "paragraph_id": "para_250" }, { "text": "The referring court states that, in view of the general terms and conditions of use of the online marketplace operated by Russmedia, although that company does not claim any right of ownership over the content of the advertisements published, it nevertheless retains the right to use that content, in …", "paragraph_id": "para_251" }, { "text": "43", "paragraph_id": "para_252" }, { "text": "In those circumstances the Curtea de Apel Cluj (Court of Appeal, Cluj) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_253" }, { "text": "‘(1) Do Articles 12 to 14 of Directive [2000/31] also apply to a storage and hosting information [society] service provider that makes available to users a website on which free or paid advertisements may be published, which claims that its role in publishing users’ advertisements is purely technica …", "paragraph_id": "para_254" }, { "text": "(2) Must Article 2(4), Article 4(7) and (11), Article 5(1)(f), Article 6(1)(a), Articles 7, 24 and 25 of [the GDPR] and Article 15 of Directive [2000/31] be interpreted as requiring such a storage and hosting information [society] service provider, which is the personal data controller, to verify before publishing an advertisement whether the person publishing the advertisement and the owner of the personal data referred to in the advertisement are the same person?", "paragraph_id": "para_255" }, { "text": "(3) Must Article 2(4), Article 4(7) and (11), Article 5(1)(f), Article 6(1)(a), Articles 7, 24 and 25 of [the GDPR] and Article 15 of Directive [2000/31] be interpreted as requiring such a storage and hosting information [society] service provider, which is the personal data controller, to verify in …", "paragraph_id": "para_256" }, { "text": "(4) Must Article 5(1)(b) and (f), Articles 24 and 25 of [the GDPR] and Article 15 of Directive [2000/31] be interpreted as requiring such a storage and hosting information [society] service provider, which is the personal data controller, to apply safeguards which prevent or limit the reproduction and redistribution of the content of the advertisements published through it?’", "paragraph_id": "para_257" }, { "text": "Consideration of the questions referred", "paragraph_id": "para_258" }, { "text": "44", "paragraph_id": "para_259" }, { "text": "According to settled case-law, in the procedure laid down by Article 267 TFEU providing for cooperation between national courts and the Court of Justice, it is for the latter to provide the national court with an answer which will be of use to it and enable it to determine the case before it. To tha …", "paragraph_id": "para_260" }, { "text": "45", "paragraph_id": "para_261" }, { "text": "The referring court’s questions seek, together, to determine, first, whether the operator of an online marketplace, such as Russmedia, which allows its users to place advertisements anonymously on its online marketplace free of charge or for a fee, has failed to fulfil its obligations under the GDPR …", "paragraph_id": "para_262" }, { "text": "46", "paragraph_id": "para_263" }, { "text": "In order to provide a useful answer to those questions, it is appropriate to examine, first of all, the second to fourth questions referred for a preliminary ruling – which seek to determine the obligations incumbent under the GDPR on an operator of an online marketplace in a situation such as that …", "paragraph_id": "para_264" }, { "text": "The second to fourth questions, concerning the interpretation of the GDPR", "paragraph_id": "para_265" }, { "text": "Preliminary remarks", "paragraph_id": "para_266" }, { "text": "47", "paragraph_id": "para_267" }, { "text": "As a preliminary point, it should be noted, in the first place, that it is apparent from the request for a preliminary ruling that the advertisement at issue presented the applicant in the main proceedings as offering sexual services, and that that advertisement contained, in particular, photographs of her, used without her consent, as well as her telephone number.", "paragraph_id": "para_268" }, { "text": "48", "paragraph_id": "para_269" }, { "text": "It is common ground that such information constitutes personal data, within the meaning of Article 4(1) of the GDPR, which defines such data as ‘any information relating to an identified or identifiable natural person,’ specifying that ‘an identifiable natural person is one who can be identified, di …", "paragraph_id": "para_270" }, { "text": "49", "paragraph_id": "para_271" }, { "text": "According to settled case-law, the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in Article 4(1) of the GDPR reflects the aim of the EU legislature to assign a wide scope to that concept, which potentially encompasses all kinds of information, not only o …", "paragraph_id": "para_272" }, { "text": "50", "paragraph_id": "para_273" }, { "text": "In addition, among those personal data, Article 9(1) of the GDPR provides for a special protection regime for special categories of data, including data concerning a natural person’s sex life or sexual orientation.", "paragraph_id": "para_274" }, { "text": "51", "paragraph_id": "para_275" }, { "text": "The Court has clarified that the purpose of Article 9(1) of that regulation is to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data processed, is liable to constitute a particularly serious interference with the fundamental rights to respect fo …", "paragraph_id": "para_276" }, { "text": "52", "paragraph_id": "para_277" }, { "text": "Such enhanced protection necessarily calls for a broad definition of such ‘sensitive data’. Thus, the Court has held that Article 9(1) of the GDPR applies to processing not only of inherently sensitive data to which that provision relates, but also of data revealing information of that nature indire …", "paragraph_id": "para_278" }, { "text": "53", "paragraph_id": "para_279" }, { "text": "In the context of that broad definition, the untrue and harmful nature of data concerning a natural person’s sex life or sexual orientation cannot mean that such data ceases to be classified as ‘sensitive data’ in terms of Article 9(1) of the GDPR.", "paragraph_id": "para_280" }, { "text": "54", "paragraph_id": "para_281" }, { "text": "In the second place, it should be noted that the processing at issue in the main proceedings consists in the publication of the advertisement in question and, therefore, of those data on Russmedia’s online marketplace. Indeed, the operation of loading personal data on a webpage constitutes processin …", "paragraph_id": "para_282" }, { "text": "55", "paragraph_id": "para_283" }, { "text": "In the third place, it should be noted that the second to fourth questions refer to the fact that the operator of the online marketplace at issue in the main proceedings is a personal data controller. However, it appears that the personal data, the publication of which is the subject of the dispute …", "paragraph_id": "para_284" }, { "text": "56", "paragraph_id": "para_285" }, { "text": "Article 4(7) of the GDPR defines the concept of ‘controller’ broadly as meaning the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.", "paragraph_id": "para_286" }, { "text": "57", "paragraph_id": "para_287" }, { "text": "The objective of that broad definition consists, in accordance with the objective pursued by the GDPR, in ensuring effective protection of the fundamental rights and freedoms of natural persons and in ensuring a high level of protection of the right of every person to the protection of personal data concerning him or her (judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21 , EU:C:2023:949 , paragraph  29 and the case-law cited).", "paragraph_id": "para_288" }, { "text": "58", "paragraph_id": "para_289" }, { "text": "Thus, any natural or legal person who exerts influence over the processing of such data, for his or her own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller in respect of such processing (judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21 , EU:C:2023:949 , paragraph  30 and the case-law cited).", "paragraph_id": "para_290" }, { "text": "59", "paragraph_id": "para_291" }, { "text": "Furthermore, since, as Article 4(7) of the GDPR expressly provides, the concept of ‘controller’ relates to the entity which ‘alone or jointly with others’ determines the purposes and means of the processing of personal data, that concept does not necessarily refer to a single entity and may concern …", "paragraph_id": "para_292" }, { "text": "60", "paragraph_id": "para_293" }, { "text": "Article 26 of the GDPR, which forms part of the framework for defining the ‘controller’ referred to in Article 4(7) of that regulation, provides, in essence, that, where two or more controllers jointly determine the purposes and means of the processing, they must be classified as ‘joint controllers’ of that processing.", "paragraph_id": "para_294" }, { "text": "61", "paragraph_id": "para_295" }, { "text": "Such joint responsibility does not necessarily require the existence of common decisions as to the determination of the purposes and means of the processing of the personal data concerned. Indeed, the Court has held that participation in the determination of the purposes and means of processing can …", "paragraph_id": "para_296" }, { "text": "62", "paragraph_id": "para_297" }, { "text": "In that regard, the joint responsibility of several actors for the same processing, under Article 4(7) of the GDPR, does not require each of them to have access to the personal data concerned (judgments of 29 July 2019, Fashion ID, C‑40/17 , EU:C:2019:629 , paragraph  69 and the case-law cited, and of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21 , EU:C:2023:949 , paragraph  42 ).", "paragraph_id": "para_298" }, { "text": "63", "paragraph_id": "para_299" }, { "text": "In the same vein, the Court has made clear that the existence of joint responsibility does not necessarily imply equal responsibility of the various operators involved in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing and to d …", "paragraph_id": "para_300" }, { "text": "64", "paragraph_id": "para_301" }, { "text": "In the present case, it is common ground that the user advertiser, who placed the untrue and harmful advertisement containing personal data of the applicant in the main proceedings on the online marketplace operated by Russmedia, must be regarded as having principally determined the purposes and means of the processing of those data and therefore falls within the concept of ‘controller’ within the meaning of Article 4(7) of the GDPR.", "paragraph_id": "para_302" }, { "text": "65", "paragraph_id": "para_303" }, { "text": "That said, it is established that that advertisement was published on the internet and thus made accessible to internet users only as a result of the online marketplace operated by Russmedia.", "paragraph_id": "para_304" }, { "text": "66", "paragraph_id": "para_305" }, { "text": "Although it is apparent from the case-law cited in paragraph 58 above that a person may be classified as a ‘controller’ of personal data only if he or she exerts influence over the processing of such data, for his or her own purposes, it should nonetheless be noted that that may be the case, inter a …", "paragraph_id": "para_306" }, { "text": "67", "paragraph_id": "para_307" }, { "text": "In the present case, it is apparent from the order for reference that Russmedia publishes advertisements on its online marketplace for its own commercial purposes. In that regard, the general terms and conditions of use of that marketplace give Russmedia considerable freedom to exploit the informati …", "paragraph_id": "para_308" }, { "text": "68", "paragraph_id": "para_309" }, { "text": "Consequently, it must be held that Russmedia exerted influence, for its own purposes, over the publication on the internet of the personal data of the applicant in the main proceedings and therefore participated in the determination of the purposes of that publication and thus of the processing at issue.", "paragraph_id": "para_310" }, { "text": "69", "paragraph_id": "para_311" }, { "text": "That finding is not called into question by the fact that Russmedia clearly did not participate in the determination of the untrue and harmful purpose pursued by the user advertiser through the publication of the advertisement at issue in the main proceedings. Indeed, Russmedia participated in the d …", "paragraph_id": "para_312" }, { "text": "70", "paragraph_id": "para_313" }, { "text": "Furthermore, by having made its online marketplace, which was used to publish the advertisement at issue in the main proceedings, available to the user advertiser, Russmedia participated in the determination of the means of that publication.", "paragraph_id": "para_314" }, { "text": "71", "paragraph_id": "para_315" }, { "text": "Indeed, the Court has already held, in essence, that a natural or legal person who exerts a decisive influence over the collection and transmission of personal data, or even a person who has an influence, by means of his or her activity of defining parameters – depending on his or her objectives of …", "paragraph_id": "para_316" }, { "text": "72", "paragraph_id": "para_317" }, { "text": "It must, therefore, be held that where the operator of an online marketplace such as Russmedia sets the parameters for the dissemination of advertisements likely to contain personal data depending on the recipients concerned, determines the presentation and duration of that dissemination or the head …", "paragraph_id": "para_318" }, { "text": "73", "paragraph_id": "para_319" }, { "text": "In that regard, the content of the general terms and conditions of use of the online marketplace concerned may provide evidence demonstrating that the operator of that marketplace exerts a decisive influence over the processing of personal data concerned and thus determines the means of that process …", "paragraph_id": "para_320" }, { "text": "74", "paragraph_id": "para_321" }, { "text": "In any event, the operator of an online marketplace cannot avoid its liability, as controller of personal data, on the ground that it has not itself determined the content of the advertisement at issue published on that marketplace. Indeed, to exclude such an operator from the definition of ‘control …", "paragraph_id": "para_322" }, { "text": "75", "paragraph_id": "para_323" }, { "text": "Accordingly, it must be held that the referring court was fully entitled to base its second to fourth questions on the premiss that, in a situation such as that at issue in the main proceedings, the operator of the online marketplace is a controller of the personal data contained in an advertisement published on that online marketplace, within the meaning of Article 4(7) of the GDPR.", "paragraph_id": "para_324" }, { "text": "76", "paragraph_id": "para_325" }, { "text": "It is in the light of all the foregoing preliminary remarks that those questions must be answered.", "paragraph_id": "para_326" }, { "text": "The second and third questions", "paragraph_id": "para_327" }, { "text": "77", "paragraph_id": "para_328" }, { "text": "By its second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 5(2) and Articles 24 to 26 of the GDPR must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of …", "paragraph_id": "para_329" }, { "text": "78", "paragraph_id": "para_330" }, { "text": "Under Article 1(2) of the GDPR, read in the light of recitals 4 and 10 thereof, that regulation has the objective in particular of ensuring a high level of protection of the fundamental rights and freedoms of natural persons with respect to the processing of personal data; that right to such protect …", "paragraph_id": "para_331" }, { "text": "79", "paragraph_id": "para_332" }, { "text": "To that end, first, Chapter II of the GDPR sets out the principles governing the processing of personal data which the controller must observe. In particular, all processing of personal data must comply with the principles relating to processing of data and the conditions governing lawfulness of pro …", "paragraph_id": "para_333" }, { "text": "80", "paragraph_id": "para_334" }, { "text": "In accordance with Article 5(1)(a) of the GDPR, personal data are to be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 5(1)(d) of the GDPR adds that personal data processed must be accurate and, where necessary, kept up to date. Thus, every reasonable …", "paragraph_id": "para_335" }, { "text": "81", "paragraph_id": "para_336" }, { "text": "As regards the conditions for lawful processing, as the Court has held, the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Processing must thus fall within one of the cases provided for in that provision (see, to that effect, judgment of 9 January 2025, Mousse, C‑394/23 , EU:C:2025:2 , paragraph  25 and the case-law cited).", "paragraph_id": "para_337" }, { "text": "82", "paragraph_id": "para_338" }, { "text": "In particular, under point (a) of the first subparagraph of Article 6(1) of the GDPR, processing of personal data is to be lawful if, and to the extent that, the data subject has given consent thereto for one or more specific purposes. Article 7(1) of that regulation states that, in that case, the c …", "paragraph_id": "para_339" }, { "text": "83", "paragraph_id": "para_340" }, { "text": "In addition to those principles and conditions, there are specific requirements for sensitive data as defined in Article 9(1) of the GDPR, the processing of which is, in principle, prohibited (see, to that effect, judgment of 21 December 2023, Krankenversicherung Nordrhein, C‑667/21 , EU:C:2023:1022 , paragraph  73 ).", "paragraph_id": "para_341" }, { "text": "84", "paragraph_id": "para_342" }, { "text": "That prohibition may be derogated from only if one of the exceptions provided for in Article 9(2)(a) to (j) of that regulation is met. Among those exceptions, which must be interpreted strictly, Article 9(2)(a) of the GDPR provides that the prohibition on processing sensitive data is not to apply if …", "paragraph_id": "para_343" }, { "text": "85", "paragraph_id": "para_344" }, { "text": "Second, Chapter IV of the GDPR clarifies the scope of the obligations incumbent on the controller of personal data, in accordance with the principle of accountability set out in Article 5(2) of the GDPR.", "paragraph_id": "para_345" }, { "text": "86", "paragraph_id": "para_346" }, { "text": "Under Article 5(2) of the GDPR, the controller is responsible for compliance with paragraph 1 of that article and must be able to demonstrate its compliance with each of the principles set out in paragraph 1 of that article, the burden of such proof thus being placed on it (judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox), C‑60/22 , EU:C:2023:373 , paragraph  53 and the case-law cited).", "paragraph_id": "para_347" }, { "text": "87", "paragraph_id": "para_348" }, { "text": "That principle of accountability of the controller is given expression in particular in Article 24 of the GDPR (see, to that effect, judgment of 25 January 2024, MediaMarktSaturn, C‑687/21 , EU:C:2024:72 , paragraph  43 and the case-law cited). That article requires that, taking into account the nat …", "paragraph_id": "para_349" }, { "text": "88", "paragraph_id": "para_350" }, { "text": "Thus, Article 5(2) and Article 24 of the GDPR impose general accountability and compliance requirements upon the controller of personal data. They require that controller to take appropriate steps to prevent any infringements of the rules laid down in the GDPR in order to ensure the right to the protection of data (see, to that effect, judgment of 27 October 2022, Proximus (Public electronic directories), C‑129/21 , EU:C:2022:833 , paragraph  81 ).", "paragraph_id": "para_351" }, { "text": "89", "paragraph_id": "para_352" }, { "text": "From that point of view, Article 25(1) of the GDPR requires that the controller must, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures that are designed to implement data-protection …", "paragraph_id": "para_353" }, { "text": "90", "paragraph_id": "para_354" }, { "text": "Where the personal data that are processed are sensitive data, in terms of Article 9(1) of the GDPR, the controller must, inter alia, in order to determine what measures are appropriate within the meaning of Articles 24 and 25 of that regulation, take account of the fact that an infringement of the …", "paragraph_id": "para_355" }, { "text": "91", "paragraph_id": "para_356" }, { "text": "It is in the light of all those clarifications that the second and third questions, as reformulated in paragraph 77 above, must be examined.", "paragraph_id": "para_357" }, { "text": "92", "paragraph_id": "para_358" }, { "text": "As regards, in the first place, the question whether the operator of an online marketplace must identify the advertisements that contain sensitive data, in terms of Article 9(1) of the GDPR, before publishing them, it must be recalled, as is apparent from paragraphs 64 and 75 above, that that operat …", "paragraph_id": "para_359" }, { "text": "93", "paragraph_id": "para_360" }, { "text": "It follows that both that operator and that user advertiser are required to ensure compliance with the obligations arising from Article 5(2) and Articles 24 and 25 of the GDPR. In particular, they must be able to demonstrate that the personal data contained in the advertisement concerned are lawfull …", "paragraph_id": "para_361" }, { "text": "94", "paragraph_id": "para_362" }, { "text": "In order to determine specifically the appropriate technical and organisational measures that the operator of an online marketplace, as joint controller of personal data, is required to implement, pursuant to Articles 24 and 25 of the GDPR, in order to ensure and be able to demonstrate that the publ …", "paragraph_id": "para_363" }, { "text": "95", "paragraph_id": "para_364" }, { "text": "In that regard, it should be noted that the publication of personal data on an online marketplace entails significant risks to the rights and freedoms of the data subject, since it makes those data accessible in principle to any internet user. In addition, once published on an online marketplace, th …", "paragraph_id": "para_365" }, { "text": "96", "paragraph_id": "para_366" }, { "text": "The risks associated with such publication are all the more serious in the case of sensitive data in terms of Article 9(1) of the GDPR. As expressly stated in recital 51 of the GDPR, personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit …", "paragraph_id": "para_367" }, { "text": "97", "paragraph_id": "para_368" }, { "text": "Accordingly, inasmuch as the operator of an online marketplace, such as the marketplace at issue in the main proceedings, knows or ought to know that, generally, advertisements containing sensitive data in terms of Article 9(1) of the GDPR, are liable to be published by user advertisers on its onlin …", "paragraph_id": "para_369" }, { "text": "98", "paragraph_id": "para_370" }, { "text": "As regards, in the second place, the question whether the operator of an online marketplace, as controller of the sensitive data contained in advertisements published on its website, jointly with the user advertiser, must verify the identity of that user advertiser before the publication, it should …", "paragraph_id": "para_371" }, { "text": "99", "paragraph_id": "para_372" }, { "text": "On that basis, while the placing by a data subject of an advertisement containing his or her sensitive data on an online marketplace may constitute explicit consent, within the meaning of Article 9(2)(a) of the GDPR, such consent is lacking where that advertisement is placed by a third party, unless …", "paragraph_id": "para_373" }, { "text": "100", "paragraph_id": "para_374" }, { "text": "In addition, it is apparent from Article 13(1)(a) and Article 14(1)(a) of the GDPR that controllers of personal data must, in any event, provide their identities and contact details to the data subject.", "paragraph_id": "para_375" }, { "text": "101", "paragraph_id": "para_376" }, { "text": "Lastly, it must be observed that Article 26 of the GDPR requires joint controllers of personal data processing to determine, in a transparent manner, their respective responsibilities for compliance with the obligations under that regulation. However, such an obligation would prove impossible if one of the controllers of that processing could remain anonymous in relation to the other.", "paragraph_id": "para_377" }, { "text": "102", "paragraph_id": "para_378" }, { "text": "It follows from the foregoing that the operator of an online marketplace, as a party responsible for publishing the sensitive data contained in an advertisement published on its online marketplace, jointly with the user advertiser, is obliged to collect the identity of that user advertiser and to verify whether that user advertiser is the person whose sensitive data appear in that advertisement.", "paragraph_id": "para_379" }, { "text": "103", "paragraph_id": "para_380" }, { "text": "In that regard, as the Advocate General observed, in essence, in point 132 of his Opinion, it is apparent from recital 75 of the GDPR that, in particular in the case of identity theft, the processing of personal data may entail risks to the rights and freedoms of data subjects which could, as a resu …", "paragraph_id": "para_381" }, { "text": "104", "paragraph_id": "para_382" }, { "text": "In those circumstances and having regard also to the considerations set out in paragraphs 95 and 96 above, in order to be able to ensure and to demonstrate that the sensitive data contained in advertisements are processed in accordance with the requirements of the GDPR, the operator of an online mar …", "paragraph_id": "para_383" }, { "text": "105", "paragraph_id": "para_384" }, { "text": "Lastly, as regards, in the third place, the question whether the operator of an online marketplace must refuse publication of an advertisement containing sensitive data where it becomes apparent – after such verification of the identity of the user advertiser who is preparing to place that advertise …", "paragraph_id": "para_385" }, { "text": "106", "paragraph_id": "para_386" }, { "text": "In the light of all the foregoing reasons, the answer to the second and third questions is that Article 5(2) and Articles 24 to 26 of the GDPR must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of the GDPR, of the personal dat …", "paragraph_id": "para_387" }, { "text": "–", "paragraph_id": "para_388" }, { "text": "to identify the advertisements that contain sensitive data in terms of Article 9(1) of the GDPR,", "paragraph_id": "para_389" }, { "text": "–", "paragraph_id": "para_390" }, { "text": "to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case,", "paragraph_id": "para_391" }, { "text": "–", "paragraph_id": "para_392" }, { "text": "to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied.", "paragraph_id": "para_393" }, { "text": "The fourth question", "paragraph_id": "para_394" }, { "text": "107", "paragraph_id": "para_395" }, { "text": "The fourth question essentially concerns whether an operator of an online marketplace, as controller, is required to implement security measures such as to prevent or limit the copying and redistribution of advertisements containing sensitive data which have been published on its online marketplace.", "paragraph_id": "para_396" }, { "text": "108", "paragraph_id": "para_397" }, { "text": "In the present case, it is apparent from the request for a preliminary ruling that the untrue and harmful advertisement at issue in the main proceedings was reproduced on other websites with advertising content, which published it by indicating the original source; in addition, in the general terms …", "paragraph_id": "para_398" }, { "text": "109", "paragraph_id": "para_399" }, { "text": "If the first part of that alternative were established, that transmission would constitute further processing of personal data for which Russmedia would be controller, within the meaning of Article 4(7) of the GDPR. That processing should be distinguished from the publication by the user advertiser of the untrue and harmful advertisement at issue in the main proceedings on Russmedia’s online marketplace.", "paragraph_id": "para_400" }, { "text": "110", "paragraph_id": "para_401" }, { "text": "Indeed, a distinction must be drawn between the various personal data processing operations forming part of the same chain of operations, in order to take account of the need to assess individually, for each person capable of being classified as a controller of personal data, the level of responsibi …", "paragraph_id": "para_402" }, { "text": "111", "paragraph_id": "para_403" }, { "text": "It follows that if personal data are subsequently transmitted under distribution contracts between the operator of the online marketplace, on which the personal data in question were initially published, and operators of other websites, that first operator is, in principle, the sole controller in respect of the processing constituted by that transmission. In all events, any controller is required, alone or jointly, to comply with all the obligations arising from the GDPR.", "paragraph_id": "para_404" }, { "text": "112", "paragraph_id": "para_405" }, { "text": "Having made those clarifications, the fourth question should be understood as referring to a situation in which Russmedia did not transfer the untrue and harmful advertisement at issue in the main proceedings to other websites with advertising content and did not, therefore, authorise those subsequent publications.", "paragraph_id": "para_406" }, { "text": "113", "paragraph_id": "para_407" }, { "text": "Moreover, it should also be observed that the fourth question essentially concerns the scope of the security obligation with which a controller of personal data must comply. As it is, Article 32 of the GDPR specifically concerns the security of processing; it gives concrete form to and specifies a p …", "paragraph_id": "para_408" }, { "text": "114", "paragraph_id": "para_409" }, { "text": "In those circumstances, it must be found that, by its fourth question, the referring court asks, in essence, whether Article 32 of the GDPR must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal …", "paragraph_id": "para_410" }, { "text": "115", "paragraph_id": "para_411" }, { "text": "Article 32(1) of the GDPR provides that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.", "paragraph_id": "para_412" }, { "text": "116", "paragraph_id": "para_413" }, { "text": "Article 32(2) of that regulation provides that, in assessing the appropriate level of security, account must be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, and unauthorised disclosure of, or access to, personal data.", "paragraph_id": "para_414" }, { "text": "117", "paragraph_id": "para_415" }, { "text": "The Court has held that the reference in Article 32(1) and (2) of the GDPR to ‘a level of security appropriate to the risk’ and to an ‘appropriate level of security’ shows that that regulation establishes a risk management system and that it in no way purports to eliminate the risks of personal data breaches (judgment of 14 December 2023, Natsionalna agentsia za prihodite, C‑340/21 , EU:C:2023:986 , paragraph  29 ).", "paragraph_id": "para_416" }, { "text": "118", "paragraph_id": "para_417" }, { "text": "Thus, it is apparent from the wording of Article 32 of the GDPR, read in conjunction with Article 24 of that regulation, that Article 32 merely requires the controller to adopt technical and organisational measures intended to avoid, in so far as it is at all possible, any personal data breach. The …", "paragraph_id": "para_418" }, { "text": "119", "paragraph_id": "para_419" }, { "text": "In that regard, in order to determine the specific risk represented by the processing concerned, account must be taken of the possible sensitivity of the personal data processed. As recalled in paragraphs 51 and 90 above, the enhanced protection, provided for in Article 9(1) of the GDPR for certain …", "paragraph_id": "para_420" }, { "text": "120", "paragraph_id": "para_421" }, { "text": "That said, once an advertisement containing personal data is online and is thus already generally accessible, the dissemination of those data entails, inter alia, the risk of a loss of control over the personal data concerned which, where it happens, deprives of all practical effect the rights and safeguards provided for by the GDPR for the benefit of the data subject, foremost among which is the right to erasure provided for in Article 17 of that regulation.", "paragraph_id": "para_422" }, { "text": "121", "paragraph_id": "para_423" }, { "text": "Thus, where sensitive data are published online, the controller is required, under Article 32 of the GDPR, to take all technical and organisational measures to ensure a level of security apt to effectively prevent the occurrence of a loss of control over those data.", "paragraph_id": "para_424" }, { "text": "122", "paragraph_id": "para_425" }, { "text": "To that end, the data controller must consider in particular all technical measures available in the current state of technical knowledge that are apt to block the copying and reproduction of online content.", "paragraph_id": "para_426" }, { "text": "123", "paragraph_id": "para_427" }, { "text": "Nevertheless, it should also be stated that Articles 24 and 32 of the GDPR cannot be understood as meaning that the unlawful dissemination of personal data initially published online is sufficient to conclude that the measures adopted by the controller concerned were not appropriate, within the mean …", "paragraph_id": "para_428" }, { "text": "124", "paragraph_id": "para_429" }, { "text": "In the present case, it is apparent from the order for reference that, despite the deletion of the untrue and harmful advertisement at issue in the main proceedings from Russmedia’s online marketplace, that advertisement is still accessible online on other websites without the applicant in the main proceedings being able, it appears, to obtain its deletion.", "paragraph_id": "para_430" }, { "text": "125", "paragraph_id": "para_431" }, { "text": "However, it appears that that loss of control originated in the unlawful initial publication of the untrue and harmful advertisement at issue in the main proceedings, in breach of the requirements laid down by the GDPR. In any event, Russmedia was required to implement appropriate technical and orga …", "paragraph_id": "para_432" }, { "text": "126", "paragraph_id": "para_433" }, { "text": "Having regard to all the foregoing reasons, the answer to the fourth question is that Article 32 of the GDPR must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisemen …", "paragraph_id": "para_434" }, { "text": "First question, concerning the interpretation of Directive 2000/31", "paragraph_id": "para_435" }, { "text": "127", "paragraph_id": "para_436" }, { "text": "As has been noted in paragraphs 45 and 46 above, the referring court also seeks to ascertain whether the operator of an online marketplace, as controller, within the meaning of Article 4(7) of the GDPR, of personal data contained in advertisements published on its online marketplace, may rely, in re …", "paragraph_id": "para_437" }, { "text": "128", "paragraph_id": "para_438" }, { "text": "The question therefore arises as to the relationship between those two instruments of EU law. In particular, it is necessary to determine whether Articles 12 to 15 of Directive 2000/31 are liable to interfere with the liability regime laid down by the GDPR.", "paragraph_id": "para_439" }, { "text": "129", "paragraph_id": "para_440" }, { "text": "In that regard, it should be noted, first, that Article 1(5)(b) of Directive 2000/31 states that that directive is not to apply to questions relating to information society services covered by Directives 95/46 and 97/66.", "paragraph_id": "para_441" }, { "text": "130", "paragraph_id": "para_442" }, { "text": "That provision has been interpreted by the Court as meaning that questions related to the protection of the confidentiality of communications and personal data must be assessed on the basis of the GDPR and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning …", "paragraph_id": "para_443" }, { "text": "131", "paragraph_id": "para_444" }, { "text": "It follows, in particular, that the possible benefit of the exemption provided for in Article 14(1) of Directive 2000/31, on which the operator of an online marketplace might be able to rely as regards the information hosted on its website, cannot interfere with the GDPR regime which applies to such an operator in the same way as to any other operator falling within the scope of that regulation.", "paragraph_id": "para_445" }, { "text": "132", "paragraph_id": "para_446" }, { "text": "The same is true of Article 15 of Directive 2000/31, under which Member States may not impose a general monitoring obligation on providers, when the latter provide the services covered by, inter alia, Article 14 of that directive. Moreover, the obligation on the operator of an online marketplace to comply with the requirements arising from the GDPR cannot, in any event, be classified as such a general monitoring obligation.", "paragraph_id": "para_447" }, { "text": "133", "paragraph_id": "para_448" }, { "text": "Second, Article 2(4) of the GDPR provides that that regulation is to be without prejudice to the application of Directive 2000/31, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that directive.", "paragraph_id": "para_449" }, { "text": "134", "paragraph_id": "para_450" }, { "text": "Article 2(4) of the GDPR must be understood as meaning that the fact that an operator has obligations laid down by the GDPR does not automatically preclude that operator from being able to rely on Articles 12 to 15 of Directive 2000/31 for matters other than those relating to the protection of personal data.", "paragraph_id": "para_451" }, { "text": "135", "paragraph_id": "para_452" }, { "text": "It thus follows from a combined reading of Article 1(5)(b) of Directive 2000/31 and Article 2(4) of the GDPR that the provisions of that directive, in particular Articles 12 to 15 thereof, cannot interfere with the regime under that regulation.", "paragraph_id": "para_453" }, { "text": "136", "paragraph_id": "para_454" }, { "text": "Having regard to all the foregoing reasons, the answer to the first question is that Article 1(5)(b) of Directive 2000/31 and Article 2(4) of the GDPR must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of the GDPR, of the pers …", "paragraph_id": "para_455" }, { "text": "Costs", "paragraph_id": "para_456" }, { "text": "137", "paragraph_id": "para_457" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_458" }, { "text": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraph_id": "para_459" }, { "text": "1.", "paragraph_id": "para_460" }, { "text": "Article 5(2) and Articles 24 to 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),", "paragraph_id": "para_461" }, { "text": "must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements and by means of appropriate technical and organisational measures,", "paragraph_id": "para_462" }, { "text": "–", "paragraph_id": "para_463" }, { "text": "to identify the advertisements that contain sensitive data in terms of Article 9(1) of that regulation,", "paragraph_id": "para_464" }, { "text": "–", "paragraph_id": "para_465" }, { "text": "to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case,", "paragraph_id": "para_466" }, { "text": "–", "paragraph_id": "para_467" }, { "text": "to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied.", "paragraph_id": "para_468" }, { "text": "2.", "paragraph_id": "para_469" }, { "text": "Article 32 of Regulation 2016/679", "paragraph_id": "para_470" }, { "text": "must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational sec …", "paragraph_id": "para_471" }, { "text": "3.", "paragraph_id": "para_472" }, { "text": "Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), and Article 2(4) of Regulation 2016/679,", "paragraph_id": "para_473" }, { "text": "must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of Regulation 2016/679, of the personal data contained in advertisements published on its online marketplace, cannot rely, in respect of an infringement of the obligations arising from Article 5(2) and Articles 24 to 26 and 32 of that regulation, on Articles 12 to 15 of that directive, relating to the liability of intermediary providers.", "paragraph_id": "para_474" }, { "text": "[Signatures]", "paragraph_id": "para_475" }, { "text": "(\n *1\n ) Language of the case: Romanian", "paragraph_id": "para_476" } ], "word_count": 15428, "cites": [ "C-324/09", "C-291/13", "C-88/99", "C-670/22", "C-710/23", "C-667/21", "C-204/21", "C-184/20", "C-683/21", "C-40/17", "C-25/17", "C-210/16", "C-460/20", "C-394/23", "C-60/22", "C-687/21", "C-129/21", "C-21/23", "C-340/21", "C-511/18", "C-512/18", "C-520/18" ], "cited_by": [], "sha256": "0af1f0f9feb3a9cf70e2c034474fb075222a5a30b649bd6c6d1539419729957b", "source_url": "https://publications.europa.eu/resource/celex/62023CJ0492.ENG.xhtml.ECR_62023CJ0492_EN_01.html", "fetched_at": "2026-09-29T08:29:43.542+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-492-23", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-492-23", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-492-23", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-492-23" }, "hash": "sha256:551a6a50bb3f63ad525f495988936c557723c3f8b5efd73d227bb79595ee375d", "version": "legal-2026-10-09", "expires": "2026-10-11T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-09+legal-2026-10-09+2026-10-09T21:48:48", "content_hash": "sha256:551a6a50bb3f63ad525f495988936c557723c3f8b5efd73d227bb79595ee375d", "revalidate_after": "2026-10-10T06:19:53.486Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-492-23", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-492-23" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-492-23" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-492-23" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "access_class": "public", "access_view": "public" }