EuGH Judgment C-210/16 on Facebook Fan Pages.
The European Court of Justice (ECJ) rules in a preliminary ruling on the joint responsibility of the operator of a Facebook fan page with the Facebook group. The implementation of the ruling means extensive information for data subjects on their rights with regard to data processing according to Art. 26 of the EU General Data Protection Regulation (GDPR) and requires the Facebook group to disclose more information about the use of the collected data.
On 5 June 2018, in the case “Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein ./. Wirtschaftsakademie Schleswig-Holstein GmbH” (Case C-210/16), the ECJ dealt with whether operators of a Facebook fan page share joint responsibility with Facebook for the processing of personal data on a fan page. In its judgment, the ECJ pointed out that “the mere fact of using a social network such as Facebook does not in itself make a Facebook user jointly responsible for the processing of personal data carried out by that network.” However, there is a joint responsibility with Facebook where the operator of a Facebook fan page contributes to the processing of personal data by Facebook. This applies where the operator determines the scope of generated visitor statistics through the filter criteria made available by Facebook, determines categories of persons to be evaluated, and thereby receives information on how to target its own information offering and to direct advertising campaigns. The parameterisation by the operator of the fan page influences the preceding data processing by Facebook and thus makes the operator jointly responsible for the data processing.
According to Article 6 (4) of the GDPR, the operator is also responsible for data processing if it processes the personal data collected via its social media presence for its own, different purposes. This is the case, for example, when data of interested parties is collected by Facebook, stored in its own customer database and used outside of Facebook for its own advertising purposes.
Where the operator of a social media presence thus bears its own responsibility or joint responsibility for data processing, it must inform the data subjects about the purpose and scope of data processing on this presence in accordance with Art. 12 ff DS-GVO. In the case of joint responsibility as in the case of fan pages, the operator of the social media presence must also comply with information obligations under Art. 26 DS-GVO. This requirement applies to Facebook fan pages, but may also affect concepts of other social media providers such as Google My Business.
In a statement, the Data Protection Conference has assessed the ECJ’s ruling and drawn up a list of measures for fan page operators. According to this:
- must be informed when visiting a fan page which data is processed for which purposes by Facebook and the fan page operator;
- the operator should ensure that Facebook provides the information needed to fulfil the aforementioned information obligations;
- the tracking of visitors through the use of cookies, the storage of the IP address, or comparable techniques generally requires the consent of the visitor in accordance with data protection law;
- the joint responsibility of Facebook and the fan page operator must be defined in an agreement as to which of them fulfils which obligation of the GDPR.
With its decision, the ECJ returns the matter to the Federal Administrative Court for a final resolution. According to the comments of the German Data Protection Commission (DSK), and without improvements by Facebook, it appears impossible to operate fan pages in compliance with data protection laws for the time being. Operators who shy away from the legal risk should deactivate their fan page. Those who accept the legal risk and want to continue operating their fan page should contact Facebook for clarification and provide as much information as possible about the joint data processing with Facebook in a special data protection statement.
References:
Landeszentrum für Datenschutz Schleswig-Holstein Wirtschaftsakademie Schleswig-Holstein GmbH (Case C-210/16) [online]. Avaiable at: http://curia.europa.eu/juris/document/document_print.jsf?doclang=DE&text=&pageIndex=0&part=1&mode=DOC&docid=202543&occ=first&dir=&cid=879236#Footnote*Conference of Independent Data Protection Authorities (2018), “The time for irresponsibility is over: ECJ confirms joint responsibility of Facebook and Fanpage operators”.