17 December 2012

Facebook Inc. (US) and Facebook Ltd. (Ireland) have come into major conflict with the Schleswig Holstein Data Protection Commissioner (ULD) as well as other data protection authorities in Germany over their refusal to permit pseudonymous accounts as required by the German Telemedia Act (TMG).

The position and orders issued by ULD can be summarised as follows:

  • Facebook Inc. and Facebook Ltd. are jointly responsible for the real name policy of Facebook and both must therefore be considered responsible in legal terms.
  • ULD is the responsible authority to enforce data protection control at Facebook for data subjects in Schleswig-Holstein  
  • Facebook must comply with Sect. 13 par. 6 TMG; this regime is in line with European law and serves, inter alia, to protect the fundamental rights and in particular the fundamental right to freedom of expression on the Internet. The legislator has made it clear that Internet services such as Facebook may be used largely unnoticed and without fear of unpleasant consequences.  
  • The permission to use pseudonyms on Facebook is reasonable. The real name obligation does neither prevent abuse of the service for insults or provocations nor does it help prevent identity theft. Against this other precautions are necessary.  
  • To ensure the data subjects' rights and data protection law in general, the real name obligation must be immediately abandoned by Facebook.

In a statement, Facebook replied:  

  • For the data processing of Facebook, Facebook Ltd. in Ireland is exclusively responsible and not the parent company in the U.S., which does nothing but process data on behalf of its subsidiary.  
  • Facebook Ltd. fully complies with Irish data protection laws which implement the European law completely.  
  • This was confirmed by the Irish Data Protection Authority as part of its audit reports dated December 2011 and September 2012.  
  • The application of the provision in Sect. 13 par. 6 TMG, which is to ensure the anonymous or pseudonymous use of Telemedia, is not applicable to Facebook and also infringes higher-ranking European law.  
  • With its real name culture Facebook is pursuing a mission of trust and security.  
  • Even if Sect. 13 par. 6 TMG was applicable, a departure from its real name culture would not be reasonable for Facebook.

Thilo Weichert, Privacy Commissioner and Head of ULD explained: “It is unacceptable that a U.S. portal like Facebook violates German data protection law unopposed and with no prospect of an end. The aim of the orders of ULD is to finally bring about a legal clarification of who is responsible for Facebook and to what this company is bound to. Actually, this should be in the interest of the company, too. In so far, we hope for a fact-based debate not aimed at delaying action. In view of the fact that Facebook currently is taking the opportunity from all its members to decide themselves about their own discoverability under their name, our initiative is more urgent than ever.”