ECJ: Facebook fanpage operators co-responsible for data processing

In a pioneering decision, the Court of Justice of the European Union (ECJ) ruled last month that the social network company as well as operators of Facebook fan pages are jointly responsible under for how data is collected and processed (Ref. C-210/16).

The decision is part of a long-lasting legal dispute between the “Wirtschaftsakademie Schleswig-Holstein”, an education company, and the regional German data protection authority. The former operates a Facebook fan page on which it advertises business offers. Facebook provides the operators of such fan pages with anonymized data on the visitors to their pages. This data is collected by storing cookies and evaluated for statistical purposes.

In 2011, the regulators ordered the Wirtschaftsakademie to deactivate the fan page on the grounds that visitors were not informed about the collection and processing of their personal data. Taking the case to court, the Wirtschaftsakademie argued that it was not responsible for the data processing and that any legal action should be brought directly against Facebook. After initially prevailing in the lower courts, the German Federal Administrative Court submitted the case to the ECJ for a preliminary ruling on the interpretation of the relevant European data protection law.

The ECJ held that Facebook is responsible for processing the personal data of visitors to fan pages. After all, the purposes and means of data processing are primarily determined by the social network company. However, the ECJ ruled that the operators of fan pages such as the Wirtschaftsakademie are not exempt from compliance with data protection obligations. Rather, they are responsible together with Facebook for protecting visitors’ personal data. This follows from the fact that the operators have access to visitor statistics – such as demographic or geographical data – and can thus design their offerings in a targeted manner. In this respect, they are involved in the decision on the purposes and means of processing personal data.

The impact of this decision is potentially far-reaching. Operators may now have to inform their visitors about what data Facebook collects and how it is processed. This should prove difficult in practice, even though Facebook promised in a statement on 15 June 2018 to support the operators in fulfilling their data protection obligations with regard to information and transparency.

The relevance of the ECJ ruling is also not necessarily precluded by the General Data Protection Regulation (GDPR) which came into force on 25 May 2018. The law applicable to the legal dispute from 2011 is no longer valid. However, the relevant provisions of the now replaced regulation have largely been incorporated into the GDPR. This indicates that the ECJ ruling continues to apply under the GDPR.

The case will now be referred back to the German Federal Administrative Court for a final decision which needs to adhere to the legal opinion of the ECJ. It remains to be seen, however, whether the Federal Administrative Court will concur with the Wirtschaftsakademie, which advocates for a model of differentiated responsibility. Accordingly, regulators would have to turn primarily to Facebook, as the processing of personal data is carried out exclusively by the social network company. In contrast to 2011, a detour via the fan page operators is no longer necessary for German authorities. The ECJ ruling paves the way for direct jurisdiction over Facebook; the Court ruled that the EU Member States' data protection authorities themselves can take action against Facebook without first having to call in the control body at the company's European headquarters in Ireland.

The final decision of the Federal Administrative Court should therefore be closely monitored. This is all the more true as this potentially affects not only the operators of Facebook fan pages. Rather, the concept of shared responsibility developed by the ECJ also appears applicable to other online services that process personal data.

ECJ press release dated 5 June 2018.

Press release of the German Federal Administrative Court dated 25 February 2016.