News

2018-06-12

Judgment of the European Court of Justice regarding the joint responsibility of the fanpage administrator and Facebook for the processing of personal data

On 5 June 2018, the Court of Justice of the European Union gave judgment in Case C-210/16, in which it replied to the question referred for a preliminary ruling concerning Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data.

The case concerned a German company conducting business in the field of education through its fan page on the social networking site Facebook. At the same time, the company used statistical data collected by using the so-called “cookies” files, made available to them free of charge via Facebook. These files are installed on the fan page users' devices when they visit the website and allow Facebook to collect and process personal data.

Based on the above the German supervisory authority ordered the company to deactivate the fan page due to the failure to inform its users about the collection of their data via Facebook. As a result of the company's complaint, the German Federal Administrative Court has asked the CJEU questions relating to the interpretation of the provisions of above-mentioned Directive.

In its ruling, the Court pointed out that it is true that by the mere fact of using the social networking site such as Facebook, its user (in this case the German company) does not become jointly responsible for the processing of personal data carried out through this portal. However, the administrator of the fan page on Facebook by creating such a site gave Facebook an opportunity to store cookies on the fan page visitors’ devices (eg.: PC) regardless of whether the person has an account on Facebook or not.

Therefore, according to the Court, the administrator of the fan page indirectly participates in defining the purposes and methods of processing personal data by setting parameters dependant among others on the target users of his fan page and objectives of managing and promoting its activities. In this case, according to the Court, it should be recognized that the administrator of the fan page is responsible at the Union level together with Facebook for the processing of data within the meaning of Directive 95/46.

The Tribunal also stressed that the fan page administrator's responsibility is even more justified when it comes to processing personal data of persons that don’t have an account on Facebook, because the mere entry on a fan page by these people results in the automatic processing of their personal data.

At the same time, the Court found that the supervisory authority of the Member States has powers of intervention in relation to an entity established in its territory, even if it is a subsidiary or branch (in this case it was a branch Facebook Germany) and even because of infringements of the rules on personal data protection by a third party established in another Member State (Facebook Ireland in the case at hand).

The full text of the CJEU judgment is available at the following link: 

https://bit.ly/2HtAugl

back