{"id":8272,"date":"2025-12-04T10:00:00","date_gmt":"2025-12-04T10:00:00","guid":{"rendered":"https:\/\/lsr.at\/?p=8272"},"modified":"2025-12-08T16:32:38","modified_gmt":"2025-12-08T16:32:38","slug":"eugh-verschaerft-datenschutzpflichten-fuer-online-marktplaetze","status":"publish","type":"post","link":"https:\/\/lsr.at\/en\/eugh-verschaerft-datenschutzpflichten-fuer-online-marktplaetze\/","title":{"rendered":"ECJ tightens data protection obligations for online marketplaces"},"content":{"rendered":"

In its judgment of December 2, 2025, in case C-492\/23 (Grand Chamber), the Court of Justice of the European Union (CJEU) established key guidelines regarding the data protection liability of online marketplaces. The decision concerns platforms where users can post advertisements \u2013 such as classifieds portals, real estate platforms, or job boards \u2013 and clarifies that operators of such services are data controllers within the meaning of the GDPR, even if the content originates from the users themselves. For platform operators, digital start-ups, and operators of online marketplaces, this judgment is a wake-up call. The CJEU requires extensive organizational, technical, and legal measures, particularly when advertisements contain sensitive data (Article 9 GDPR).<\/p>\n\n\n\n

The plaintiff (\u201eX\u201c) found several advertisements on a Romanian online marketplace in which her name and photo were used without her consent \u2013 specifically in connection with escort services and indications of her sexual preferences. The advertisements were created by private users; the platform operator, \u201eRussmedia Digital,\u201c merely provided the technical infrastructure and monetized the content through advertising. The platform responded immediately to the report and arranged for the deletion of the posts.<\/p>\n\n\n\n

While the court of first instance ordered Russmedia to pay damages, the court of appeal held that the portal was merely a "hosting provider" and could therefore invoke the liability privilege of the E-Commerce Directive (Article 14 of Directive 2000\/31\/EC). The Romanian court subsequently referred several questions concerning the interpretation of the GDPR and its relationship to the E-Commerce Directive to the CJEU.<\/p>\n\n\n\n

In case C-492\/23, the ECJ makes several fundamental statements that will be decisive for all online marketplaces in the future:<\/p>\n\n\n\n

    \n
  1. Platform operators are data controllers within the meaning of Article 4(7) GDPR: The operator decides on the purposes and means of processing (structuring, publication, presentation, search, sorting). Without these decisions, the actual data processing would not take place. The operator therefore bears full responsibility under data protection law.<\/li>\n\n\n\n
  2. Joint responsibility with users (Art. 26 GDPR): Insofar as users create advertisements and the operator sets the framework for publication, there is regularly a so-called "joint responsibility".<\/li>\n\n\n\n
  3. Processing sensitive data requires special protective measures: If an advertisement contains, for example, data about health, sex life, political opinions, or religious beliefs, the operator must check before (!) publication whether a valid legal basis \u2013 usually explicit consent \u2013 exists. If this is not the case, the advertisement may not be published.<\/li>\n\n\n\n
  4. Obligation to implement \u201ePrivacy by Design\u201c and \u201eAccountability\u201c (Article 5(2), Articles 24, 25, 32 GDPR): The CJEU requires that platforms have effective technical and organizational measures in place to prevent unlawful advertising. These include automated filters or AI-supported detection of sensitive content, manual review processes, clear upload rules, technical restrictions, category limitations, and measures to prevent redistribution (e.g., watermarks, anti-scraping protection).<\/li>\n\n\n\n
  5. No reliance on the host provider privilege: According to the ECJ, the liability privilege of the E-Commerce Directive only protects against civil liability, but not against public law obligations under the GDPR.<\/li>\n<\/ol>\n\n\n\n

    The ruling consistently follows the line of recent CJEU case law on platform responsibility. It is a milestone for the data protection responsibility of online marketplaces. The CJEU makes it clear: operators cannot hide behind user-generated content. They must implement active, effective, and verifiable measures to prevent unlawful advertisements \u2013 especially when sensitive data is involved.<\/p>\n\n\n\n

    ECJ 02.12.2025, Case C-492\/23<\/p>\n\n\n\n

    04.12.2025<\/p>\n\n\n\n

    <\/p>","protected":false},"excerpt":{"rendered":"

    In its judgment of 2 December 2025 in case C-492\/23 (Grand Chamber), the Court of Justice of the European Union (CJEU) established essential guidelines on the data protection responsibility of online marketplaces. <\/p>","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[41],"tags":[],"class_list":["post-8272","post","type-post","status-publish","format-standard","hentry","category-aktuelles"],"acf":[],"_links":{"self":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts\/8272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/comments?post=8272"}],"version-history":[{"count":3,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts\/8272\/revisions"}],"predecessor-version":[{"id":8279,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts\/8272\/revisions\/8279"}],"wp:attachment":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/media?parent=8272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/categories?post=8272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/tags?post=8272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}