Brief IP news

briefs_1131. Protecting your shop interior: what are the options? For more information here.

2. Protecting your intellectual property. For more information here.

3. Patentability of pharmaceutical inventions, 15.01.2020 – 16.01.2020, Brussels. For more information here.

Source: Intellectual Property Center at the UNWE. More information can be found here

Google with a key victory regarding the right to be forgotten – an EU Court decision

pexels-photo-67112.jpegThe European Court has issued a decision on the case C‑507/17 Google LLC, правоприемник на Google Inc. v Commission nationale de l’informatique et des libertés (CNIL). In brief, this case concerns the right to be forgotten when it comes to searches on the internet. In details:

By decision of 21 May 2015, the President of the CNIL served formal notice on Google that, when granting a request from a natural person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person’s name, it must apply that removal to all its search engine’s domain name extensions.

Google refused to comply with that formal notice, confining itself to removing the links in question from only the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States.

The CNIL also regarded as insufficient Google’s further ‘geo-blocking’ proposal, made after expiry of the time limit laid down in the formal notice, whereby internet users would be prevented from accessing the results at issue from an IP (Internet Protocol) address deemed to be located in the State of residence of a data subject after conducting a search on the basis of that data subject’s name, no matter which version of the search engine they used.

By an adjudication of 10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice within the prescribed period, imposed a penalty on that company of EUR 100 000, which was made public.

By application lodged with the Conseil d’État (Council of State, France), Google seeks annulment of that adjudication.

The Conseil d’État notes that the processing of personal data carried out by the search engine operated by Google falls within the scope of the Law of 6 January 1978, in view of the activities of promoting and selling advertising space carried on in France by its subsidiary Google France.

The Conseil d’État also notes that the search engine operated by Google is broken down into different domain names by geographical extensions, in order to tailor the results displayed to the specificities, particularly the linguistic specificities, of the various States in which that company carries on its activities. Where the search is conducted from ‘google.com’, Google, in principle, automatically redirects that search to the domain name corresponding to the State from which that search is deemed to have been made, as identified by the internet user’s IP address. However, regardless of his or her location, the internet user remains free to conduct his or her searches using the search engine’s other domain names. Moreover, although the results may differ depending on the domain name from which the search is conducted on the search engine, it is common ground that the links displayed in response to a search derive from common databases and common indexing.

The Conseil d’État considers that, having regard, first, to the fact that Google’s search engine domain names can all be accessed from French territory and, secondly, to the existence of gateways between those various domain names, as illustrated in particular by the automatic redirection mentioned above, as well as by the presence of cookies on extensions of that search engine other than the one on which they were initially deposited, that search engine, which, moreover, has been the subject of only one declaration to the CNIL, must be regarded as carrying out a single act of personal data processing for the purposes of applying the Law of 6 January 1978. As a result, the processing of personal data by the search engine operated by Google is carried out within the framework of one of its installations, Google France, established on French territory, and is therefore subject to the Law of 6 January 1978.

Before the Conseil d’État, Google maintains that the penalty at issue is based on a misinterpretation of the provisions of the Law of 6 January 1978, which transpose Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46, on the basis of which the Court, in its judgment of 13 May 2014, Google Spain and Google (C‑131/12, EU:C:2014:317), recognised a ‘right to de-referencing’. Google argues that this right does not necessarily require that the links at issue are to be removed, without geographical limitation, from all its search engine’s domain names. In addition, by adopting such an interpretation, the CNIL disregarded the principles of courtesy and non-interference recognised by public international law and disproportionately infringed the freedoms of expression, information, communication and the press guaranteed, in particular, by Article 11 of the Charter.

Having noted that this line of argument raises several serious difficulties regarding the interpretation of Directive 95/46, the Conseil d’État has decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Must the “right to de-referencing”, as established by the [Court] in its judgment of 13 May 2014, [Google Spain and Google (C‑131/12, EU:C:2014:317),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first paragraph of Article 14] of Directive [95/46], be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46]?

(2) In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States …?

3.  Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing” as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the “geo-blocking” technique, from searches conducted on the basis of the requester’s name from an IP address deemed to be located in the State of residence of the person benefiting from the “right to de-referencing”, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive [95/46], regardless of the domain name used by the internet user conducting the search?’

The Court’s decision:

On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and of Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation), where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.

Facebook lost a takedown order lawsuit in the EU

pexels-photo-927629.jpegThe European Court has issued a decision on the case Case C‑18/18, Eva Glawischnig-Piesczek v Facebook Ireland Limited, which concerns the following:

Ms Eva Glawischnig-Piesczek was a member of the Nationalrat (National Council, Austria), chair of the parliamentary party ‘die Grünen’ (The Greens) and federal spokesperson for that party.

Facebook Ireland operates a global social media platform (‘Facebook Service’) for users located outside the United States of America and Canada.

On 3 April 2016, a Facebook Service user shared on that user’s personal page an article from the Austrian online news magazine oe24.at entitled ‘Greens: Minimum income for refugees should stay’, which had the effect of generating on that page a ‘thumbnail’ of the original site, containing the title and a brief summary of the article, and a photograph of Ms Glawischnig-Piesczek. That user also published, in connection with that article, a comment which the referring court found to be harmful to the reputation of the applicant in the main proceedings, and which insulted and defamed her. This post could be accessed by any Facebook user.

By letter of 7 July 2016, Ms Glawischnig-Piesczek, inter alia, asked Facebook Ireland to delete that comment.

Because Facebook Ireland did not withdraw the comment in question, Ms Glawischnig-Piesczek brought an action before the Handelsgericht Wien (Commercial Court, Vienna, Austria) which, by interim order of 7 December 2016, directed Facebook Ireland, with immediate effect and until the proceedings relating to the action for a prohibitory injunction have been finally concluded, to cease and desist from publishing and/or disseminating photographs showing the applicant [in the main proceedings] if the accompanying text contained the assertions, verbatim and/or using words having an equivalent meaning as that of the comment referred to in paragraph 12 above.

Facebook Ireland disabled access in Austria to the content initially published.

On appeal, the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria) upheld the order made at first instance as regards the identical allegations. However, it also held that the dissemination of allegations of equivalent content had to cease only as regards those brought to the knowledge of Facebook Ireland by the applicant in the main proceedings, by third parties or otherwise.

The Handelsgericht Wien (Commercial Court, Vienna) and the Oberlandesgericht Wien (Higher Regional Court, Vienna) based their decisions on Paragraph 78 of the Law on copyright and Paragraph 1330 of the General Civil Code, on the ground, inter alia, that the published comment contained statements which were excessively harmful to the reputation of Ms Glawischnig-Piesczek and, in addition, gave the impression that she was involved in unlawful conduct, without providing the slightest evidence in that regard.

Each of the parties in the main proceedings lodged appeals on a point of law at the Oberster Gerichtshof (Supreme Court, Austria).

Having been called on to adjudicate whether the cease and desist order made against a host provider which operates a social network with a large number of users may also be extended to statements with identical wording and/or having equivalent content of which it is not aware, the Oberster Gerichtshof (Supreme Court) states that, in accordance with its own case-law, such an obligation must be considered to be proportionate where the host provider was already aware that the interests of the person concerned had been harmed on at least one occasion as a result of a user’s post and the risk that other infringements may be committed is thus demonstrated.

However, considering that the dispute before it raises questions of the interpretation of EU law, the Oberster Gerichtshof (Supreme Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Does Article 15(1) of Directive [2000/31] generally preclude any of the obligations listed below of a host provider which has not expeditiously removed illegal information, specifically not just this illegal information within the meaning of Article 14(1)(a) of [that] directive, but also other identically worded items of information:

–  worldwide;

–  in the relevant Member State;

–  of the relevant user worldwide;

–  of the relevant user in the relevant Member State?

(2) In so far as Question 1 is answered in the negative: does this also apply in each case for information with an equivalent meaning?

(3) Does this also apply for information with an equivalent meaning as soon as the operator has become aware of this circumstance?’

The Court’s decision:

Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), in particular Article 15(1), must be interpreted as meaning that it does not preclude a court of a Member State from:

– ordering a host provider to remove information which it stores, the content of which is identical to the content of information which was previously declared to be unlawful, or to block access to that information, irrespective of who requested the storage of that information;

– ordering a host provider to remove information which it stores, the content of which is equivalent to the content of information which was previously declared to be unlawful, or to block access to that information, provided that the monitoring of and search for the information concerned by such an injunction are limited to information conveying a message the content of which remains essentially unchanged compared with the content which gave rise to the finding of illegality and containing the elements specified in the injunction, and provided that the differences in the wording of that equivalent content, compared with the wording characterising the information which was previously declared to be illegal, are not such as to require the host provider to carry out an independent assessment of that content, and

–  ordering a host provider to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law.

Where a trademark lawsuit has to be initiated in case of online sales in the EU?

buy-3692440_960_720.jpgThe European Court has ruled in case C‑172/18 AMS Netve Ltd, Barnett Waddingham Trustees, Mark Crabtree v Heritage Audio SL, Pedro Rodríguez Arribas. This case concerns the territory where a trademark lawsuit has to be initiated in case of online sales. In details:

AMS Neve is a company established in the United Kingdom which manufactures and sells audio equipment. BW Trustees, also established in the United Kingdom, is the trustee of the AMS Neve executive pension scheme. Mr Crabtree is a director of AMS Neve.

Heritage Audio is a company established in Spain which sells and supplies audio equipment. Mr Rodríguez Arribas, who is domiciled in Spain, is the sole director of Heritage Audio.

On 15 October 2015 AMS Neve, BW Trustees and Mr Crabtree brought an action against Heritage Audio and Mr Rodríguez Arribas before the Intellectual Property and Enterprise Court (United Kingdom) claiming infringement of an EU trade mark of which BW Trustees and Mr Crabtree are the proprietors and for the use of which AMS Neve is exclusively licensed.

Their action concerns, in addition, the alleged infringement of two marks registered in the United Kingdom of which BW Trustees and Mr Crabtree are also the proprietors.

The EU trade mark relied on consists of the figure 1073 and was registered for goods within Class 9 of the Nice Agreement concerning the International Classification of Goods and Services for the Purposes of the Registration of Marks of 15 June 1957, as revised and amended. The description of the goods covered is in part as follows: ‘sound studio recording, mixing and processing equipment’.

The defendants in the main proceedings are alleged to have offered for sale to consumers in the United Kingdom imitations of goods of AMS Neve bearing a sign that is identical or similar to that EU trade mark and to the national trade marks or referring to that sign, and to have advertised those products.

The applicants in the main proceedings have submitted documents in support of their action, including the contents of the Heritage Audio website and the latter’s Facebook and Twitter accounts, an invoice issued by Heritage Audio to an individual residing in the United Kingdom and correspondence between Heritage Audio and a person established in the United Kingdom concerning possible deliveries of audio equipment.

The applicants in the main proceedings have in particular submitted screenshots from that website on which they claim appeared offers to sell audio equipment bearing a sign identical or similar to that EU trade mark. They have stressed that the offers for sale are worded in English and that a section headed ‘where to buy’ lists distributors established in various countries, including the United Kingdom. Further, they claim that it is apparent from the general sale conditions that Heritage Audio accepts orders from any EU Member State.

The defendants in the main proceedings pleaded that the court before which the action was brought had no jurisdiction.

While the defendants do not deny that Heritage Audio products might have been purchased, in the United Kingdom, through other companies, they assert that they have not, themselves, either advertised in the United Kingdom or made any sales in that Member State. They further assert that they have never appointed a distributor for the United Kingdom. Last, they contend that the content displayed on the Heritage Audio website and on the platforms to which the applicants in the main proceedings refer was, by the time of the period covered by the infringement action, obsolete and ought not therefore to be taken into account.

By judgment of 18 October 2016, the Intellectual Property and Enterprise Court held that it had no jurisdiction to hear the infringement action in so far as that action is based on the EU trade mark at issue.

That court states that the applicants in the main proceedings submitted evidence capable of proving that the Heritage Audio website was directed to, inter alia, the United Kingdom. That court considers, further, that the facts of the dispute before it enable it to find that Mr Rodríguez Arribas is jointly liable for the acts of Heritage Audio and that the courts of the United Kingdom have jurisdiction to hear the case in so far as that dispute concerns the protection of national intellectual property rights.

The Intellectual Property and Enterprise Court considers, on the other hand, that that dispute, in so far as it concerns infringement of the EU trade mark, is subject, in accordance with Article 97(1) of Regulation No 207/2009, to the jurisdiction of the courts of the Member State in whose territory the defendant is domiciled, in this case the Kingdom of Spain. The Intellectual Property and Enterprise Court adds that the jurisdiction of the Spanish courts also stems from Article 97(5) of that regulation, under which infringement actions may also be brought before the courts of the Member State in whose territory the act of infringement has been committed.

As regards the latter provision, the Intellectual Property and Enterprise Court considers that the court which has territorial jurisdiction to hear an action brought by the proprietor of a mark against a third party that has used signs identical or similar to that mark in advertising and offers for sale on a website or on social media platforms is the court with jurisdiction over the place where the third party decided to place that advertising or to offer for sale products on that site or on those platforms and took steps to give effect to that decision.

The applicants in the main proceedings brought an appeal against that judgment before the Court of Appeal (England & Wales) (Civil Division).

The referring court considers that the court of first instance, while referring in its judgment to certain judgments of the Court, such as those of 19 April 2012, Wintersteiger (C‑523/10, EU:C:2012:220), and of 5 June 2014, Coty Germany (C‑360/12, EU:C:2014:1318), misinterpreted those judgments and the case-law of the Court in general.

The referring court is of the opinion that such an interpretation would lead, in essence, to a finding that ‘the Member State in which the act of infringement has been committed’, within the meaning of Article 97(5) of Regulation No 207/2009, is the Member State in which the defendant set up its website and its social media accounts. According to the referring court, it follows, however, from the wording, purpose and context of that provision that the territory of the Member State subject to that provision is that in which the consumers or traders to whom the advertising and offers for sale are directed are resident.

The referring court adds that the Bundesgerichtshof (Federal Court of Justice, Germany), in its ‘Parfummarken’ judgment of 9 November 2017 (I ZR 164/16), held that the interpretation of the wording ‘law of the country in which the act of infringement was committed’, in Article 8(2) of Regulation (EC) No 864/2007 of the European Parliament and of the Council of 11 July 2007 on the law applicable to non-contractual obligations (Rome II) (OJ 2007 L 199, p. 40), adopted in the judgment of 27 September 2017, Nintendo (C‑24/16 and C‑25/16, EU:C:2017:724), can be transposed to Article 97(5) of Regulation No 207/2009. However, the referring court has some doubts with regard to that finding of the Bundesgerichtshof.

In those circumstances, the Court of Appeal (England & Wales) (Civil Division) decided to stay proceedings and to refer to the Court the following question for a preliminary ruling, adding in its decision that that question concerns the interpretation of Article 97(5) of Regulation No 207/2009:

‘In circumstances where an undertaking is established and domiciled in Member State A and has taken steps in that territory to advertise and offer for sale goods under a sign identical to an EU trade mark on a website targeted at traders and consumers in Member State B:

(i)  does an EU trade mark court in Member State B have jurisdiction to hear a claim for infringement of the EU trade mark in respect of the advertisement and offer for sale of the goods in that territory?

(ii)  if not, which other criteria are to be taken into account by that EU trade mark court in determining whether it has jurisdiction to hear that claim?

(iii)  in so far as the answer to (ii) requires that EU trade mark court to identify whether the undertaking has taken active steps in Member State B, which criteria are to be taken into account in determining whether the undertaking has taken such active steps?’

The Court’s decision:

Article 97(5) of Council Regulation (EC) No 207/2009 of 26 February 2009 on the [European Union] trade mark must be interpreted as meaning that the proprietor of a European Union trade mark who considers that his rights have been infringed by the use without his consent, by a third party, of a sign identical to that mark in advertising and offers for sale displayed electronically in relation to products that are identical or similar to the goods for which that mark is registered, may bring an infringement action against that third party before a European Union trade mark court of the Member State within which the consumers or traders to whom that advertising and those offers for sale are directed are located, notwithstanding that that third party took decisions and steps in another Member State to bring about that electronic display.

EasyJet won a dispute against EZY.COM in the UK

plane-841441_960_720.jpgThe UK airline company EasyGroup won an invalidation procedure against the UK registered trademark EZY.COM in class 41.

The base for this invalidation was earlier trademarks EASY.COM and EASYJET for class 41.

According to the company, there was a serious possibility for consumer confusion including because of the fact that EASYJET has a reputation in the UK and because EZY was the airline code of the company.

The UKIPO upheld the opposition confirming the possible consumer confusion due to the phonetic and visual similarities between the signs which are registered for identical and similar services.

Source: WIPR.

Uber won a dispute in the UK

london-722520_960_720Uber succeeded in an opposition procedure against the following UK trademark application:

GB50000000003168791.jpg

This sign was filed for the following goods and services:

In Class 9: Mobile phones and accessories; batteries; battery charges; media for storing
information, data, signals, images and/or sounds; photographic apparatus and instruments; parts and fittings for the aforesaid goods.

In Class 35: Retail services connected with the sale of mobile phones and accessories;
batteries; battery charges; media for storing information, data, signals, images and/or sounds; photographic apparatus and instruments; parts and fittings for the aforesaid goods”.

In Class 38: Advisory and consultancy services relating to communications apparatus,
equipment and accessories; rental and hire of communications apparatus, equipment, and accessories; provision of information relating to communications apparatus, equipment and accessories”.

Uber invoked a family of earlier Uber trademarks against this application, for the same classes, stating possible consumer confusion.

According to the UKIPO the goods and services of the marks were identical or complementary.

The applicant tried to claim that Uberfone poses a specific meaning in German which is to something “superb or happy”.

The Office dismissed it considering that the German language is not so popular in the UK and most of the people wouldn’t be able to get the meaning.

Taking into account the phonetic and visual similarities between the signs, the UKIPO upheld the opposition.

Source: WIPR.

How clicking on the thumb reflect on your privacy?

like-3033202_960_720.jpgThe Advocate General of the European Court has given its opinion on case C‑40/17 Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW e.V., Facebook Ireland Limited, Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

The case concerns the following thumb case:

Fashion ID (‘the Defendant’)’ is an online retailer. It sells fashion items on its website. The Defendant embedded the ‘Like’ plug-in supplied by Facebook Ireland Limited (‘Facebook Ireland’)(4) in its website. As a result the so-called Facebook ‘Like’ button appears on the Defendant’s website.

The order for reference further explains how the (non-visible) part of the plug-in functions: when a visitor lands on the Defendant’s website on which the Facebook ‘Like’ button is placed, his browser automatically sends information concerning his IP address and browser string to Facebook Ireland. The transmission of this information occurs without it being necessary to actually click on the Facebook ‘Like’ button. It also seems to follow from the order for reference that when the Defendant’s website is visited, Facebook Ireland places different kinds of cookies (session, datr and fr cookies) on the user’s device.

Verbraucherzentrale NRW (‘the Applicant’), a consumer protection association, brought judicial proceedings against the Defendant before a Landgericht (District Court, Germany). The Applicant sought an order to force the Defendant to cease integrating the social plug-in ‘Like’ from Facebook on the grounds that the Defendant allegedly did not:

–   ‘expressly and clearly explain the purpose of the collection and use of the data transmitted in that way to users of the internet page before the provider of the plug-in begins to access the user’s IP address and browser string, and/or

–  obtain the consent of users of the internet page to access to their IP address and browser string by the plug-in provider and to the data usage, in each case prior to the access occurring, and/or

–   inform users who have given their consent within the meaning of second head of claim that this can be revoked at any time with effect for the future, and/or

–   inform that “If you are a user of a social network and do not wish that social network to collect data about you via our website and link these to your user data saved on the social network, you must log out of the social network before visiting our website”.’

The Applicant claimed that Facebook Inc. or Facebook Ireland saves the IP address and browser string and links them to a specific user (member or non-member). The Defendant’s argument in response is a lack of knowledge in this respect. Facebook Ireland argues that the IP address is converted to a generic IP address and is saved only in this form and that there is no allocation of the IP address and browser string to user accounts.

The Landgericht (District Court) ruled against the Defendant on the first three pleas. The Defendant appealed. A cross-appeal was lodged by the Applicant in respect of the fourth plea.

It is within that factual and legal context that the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf) decided to refer the following questions to the Court:

‘(1)  Do the rules in Articles 22, 23 and 24 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) preclude national legislation which, in addition to the powers of intervention conferred on the data-protection authorities and the remedies available to the data subject, grants public-service associations the power to take action against the infringer in the event of an infringement in order to safeguard the interests of consumers?

If Question 1 is answered in the negative:

(2)  In a case such as the present one, in which someone has embedded a programming code in his website which causes the user’s browser to request content from a third party and, to this end, transmits personal data to the third party, is the person embedding the content the “controller” within the meaning of Article 2(d) of [Directive 95/46] if that person is himself unable to influence this data- processing operation?

(3)  If Question 2 is answered in the negative: Is Article 2(d) of [Directive 95/46] to be interpreted as meaning that it definitively regulates liability and responsibility in such a way that it precludes civil claims against a third party who, although not a “controller”, nonetheless creates the cause for the processing operation, without influencing it?

(4) Whose “legitimate interests”, in a situation such as the present one, are the decisive ones in the balancing of interests to be undertaken pursuant to Article 7(f) of [Directive 95/46]? Is it the interests in embedding third-party content or the interests of the third party?

(5)  To whom must the consent to be declared under Articles 7(a) and 2(h) of [Directive 95/46] be made in a situation such as that in the present case?

(6)      Does the duty to inform under Article 10 of [Directive 95/46] also apply in a situation such as that in the present case to the operator of the website who has embedded the content of a third party and thus creates the cause for the processing of personal data by the third party?

The Advocate’s opinion:

–  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data does not preclude national legislation which grants public-service associations standing to commence legal proceedings against the alleged infringer of data protection legislation in order to safeguard the interests of consumers.

–  A person that has embedded a third-party plug-in in its website, which causes the collection and transmission of the user’s personal data (that third party having provided the plug-in), shall be considered to be a controller within the meaning of Article 2(d) of Directive 95/46. However, that controller’s (joint) responsibility is limited to those operations for which it effectively co-decides on the means and purposes of the processing of the personal data.

–   For the purpose of the assessment of the possibility to process personal data under the conditions set out in Article 7(f) of Directive 95/46, the legitimate interests of both joint controllers at issue have to be taken into account and balanced against the rights of the data subjects.

–  The consent of the data subject obtained under Article 7(a) of Directive 95/46 has to be given to a website operator which has embedded the content of a third party. Article 10 of Directive 95/46 shall be interpreted as meaning that the obligation to inform under that provision also applies to that website operator. The consent of the data subject under Article 7(a) of Directive 95/46 has to be given, and information within the meaning of Article 10 of the same directive provided before the data are collected and transferred. However, the extent of those obligations shall correspond with that operator’s joint responsibility for the collection and transmission of the personal data.