In its decision C-210/16 of 5 June 2018, the European Court of Justice (ECJ) ruled on a dispute between a German academic institution and a German data protection authority. The institution operated a fan page on Facebook and collected user data via cookies, which were placed by means of a function called "Facebook Insights". The purpose of the data collection was to provide statistics to administrators of fan pages and to publish targeted advertisements. The data protection authority ordered the institution to stop collecting the data and to deactivate its fan page, since the authority identified deficiencies in the information provided about the data collection.
The institution challenged the order by denying its legal liability for the processing of personal data on Facebook. It also denied having provided instructions to Facebook as regards data processing and claimed that the German data protection authority should have taken action directly against Facebook, not against the institution.
The appeal proceedings examined whether the institution could take the position of a data controller (in terms of German data protection law) or whether that position pertains solely to Facebook. The Bundesverwaltungsgericht ultimately asked the ECJ for clarification.
Considerations of the ECJ
The ECJ ruled as follows:
- The ECJ understood fan pages to be user accounts set up on Facebook by individuals or businesses. They serve to introduce oneself to users and to post communications. The ECJ further understood that Facebook Insights places cookies on the computer of a user visiting the fan page. Facebook receives information via those cookies.
- ! Based on this understanding, the ECJ generally ruled that the mere use of Facebook does not make the user responsible for the processing of personal data on Facebook.
- However, the ECJ took into consideration that Facebook Insights allows the administrator of a fan page to place cookies on the computer of a user visiting the fan page. Facebook provides statistics about user behaviour based on the information collected thought those cookies. ! In the view of the ECJ, the fan page administrator must therefore be seen as a controller responsible for that processing jointly with Facebook.
- The ECJ emphasised that fan pages can also be visited by third parties that are not Facebook users and so do not have a user account on Facebook. The Court regarded the liability of the fan page administrator for such third parties even higher. ! However, the Court did not necessarily see equal liability in all circumstances, so that the level of liability of both Facebook and the administrator must be assessed with regard to the relevant circumstances of the case.
- The ECJ further attributed the data processing to Facebook Germany, even though it was not directly involved in the present scenario. Consequently, according to the ECJ, German data protection law is applicable to Facebook's processing in Germany and German data protection authorities are competent to apply that law to Facebook Germany.
Potential impact of the ruling