EU GDPR obligations and platform liability (X v Russmedia)
EU Law analysis: The operator of an online marketplace on which an advertisement was placed was found not to have complied with its obligations under the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR), despite promptly removing the advert less than an hour after receiving a removal request. The court held that it was a joint controller of the sensitive personal data contained in the advert and should have implemented measures prior to publication to (i) identify advertisements that contain sensitive personal data, (ii) verify that the advertiser is the person whose sensitive personal data appears in the advertisement and, if not, establish that explicit consent has been given by the data subject, and (iii) put in place safeguards to prevent further distribution or dissemination of the unlawful advertisements. The operator’s EU GDPR obligations were not limited by the safe harbour provisions set out in Article 14 of Directive 2000/31/EC (the E-Commerce Directive). Written by Hind Habib, partner and Sarah Reynolds, senior associate at Schillings.