The data protection authority may act both against the administrator and against Facebook subsidiary
The German Wirtschaftsakademie Schleswig-Holstein offers educational services inter alia by means of a fan page hosted on Facebook.
Administrators of fan pages, such as Wirtschaftsakademie, can obtain anonymous statistical data on visitors to the fan pages via a function called ‘Facebook Insights’ which Facebook makes available to them. The data is collected by means of ‘cookies’, which are active for two years and are stored by Facebook on the computer of visitors to the fan page. The user code, which can be matched with the connection data of users registered on Facebook, is collected and processed when the fan pages are opened.
By decision of 3 November 2011, the Independent Data Protection Centre for the Land of Schleswig-Holstein, Germany ordered Wirtschaftsakademie to deactivate its fan page. According to the Unabhängiges Landeszentrum, neither Wirtschaftsakademie nor Facebook informed visitors to the fan page that Facebook, by means of cookies, collected personal data concerning them and then processed the data.
Wirtschaftsakademie brought an action against that decision before the German administrative courts, arguing that the processing of personal data by Facebook could not be attributed to it, and that it had not commissioned Facebook to process data that it controlled or was able to influence. Wirtschaftsakademie concluded that the Unabhängiges Landeszentrum should have acted directly against Facebook instead of against it.
In the judgment C-2016 of June 5, 2018,the European Court of Justice started by observing that it is not disputed in the present case that the American company Facebook and, for the EU, its Irish subsidiary Facebook Ireland must be regarded as ‘controllers’ responsible for processing the personal analytical data of Facebook users and persons visiting the fan pages hosted on Facebook. Those companies primarily determine the purposes and means of processing that data.
Next, the Court finds that an administrator such as Wirtschaftsakademie must be regarded as a controller jointly responsible, within the EU, with Facebook Ireland for the processing of that data.
Such an administrator takes part, by its definition of parameters (depending in particular on its target audience and the objectives of manging or promoting its own activities), in the determination of the purposes and means of processing the personal data of the visitors to its fan page. In particular, the Court notes that the administrator of the fan page can ask for demographic data (in anonymised form) – and thereby request the processing of that data – concerning its target audience and geographical data, telling the fan page administrator where to make special offers.
According to the Court, the fact that an administrator of a fan page uses the platform provided by Facebook in order to benefit from the associated services cannot exempt it from compliance with its obligations concerning the protection of personal data.