Conversation

Interesting case on the intersection of the e-Commerce Directive 2000 and the GDPR. n.b. that parts of the e-Commerce directive referenced in this decision have been replaced by the Digital Services Act 2022, but I don’t think there would be any impact here.

The TL;DR appears to be that if your T&Cs are overbroad, you are no longer a mere conduit under the e-Commerce Directive/DSA and thereby you are responsible for any data published:

66 Although it is apparent from the case-law cited in paragraph 58 above that a person may be classified as a ‘controller’ of personal data only if he or she exerts influence over the processing of such data, for his or her own purposes, it should nonetheless be noted that that may be the case, inter alia, where the operator of an online marketplace publishes the personal data concerned for commercial or advertising purposes which go beyond the mere provision of a service which he or she provides to the user advertiser.

67 In the present case, it is apparent from the order for reference that Russmedia publishes advertisements on its online marketplace for its own commercial purposes. In that regard, the general terms and conditions of use of that marketplace give Russmedia considerable freedom to exploit the information published on that marketplace. In particular, according to the information provided by the referring court, Russmedia reserves the right to use published content, distribute it, transmit it, reproduce it, modify it, translate it, transfer it to partners and remove it at any time, without the need for any ‘valid’ reason for so doing. Russmedia therefore publishes the personal data contained in the advertisements not on behalf of the user advertisers, or not solely on their behalf, but processes and can exploit those data for its own advertising and commercial purposes.

68 Consequently, it must be held that Russmedia exerted influence, for its own purposes, over the publication on the internet of the personal data of the applicant in the main proceedings and therefore participated in the determination of the purposes of that publication and thus of the processing at issue.

In summary: keep any rights reservations in your T&C concise and to the point