Background to yesterday’s ECJ ruling (Rs. C‑210/16) was a cease-and-desist order issued by the “Independent State Center for Data Protection Schleswig-Holstein” (ULD) against the operator of a fan page by Wirtschaftsakademie Schleswig-Holstein GmbH. The ULD justified the prohibitions on the grounds that Facebook was committing data protection violations and that the operators of Facebook pages were jointly responsible for them.
Facebook places cookies on the end devices of visitors to the corresponding pages and collects their user code, which can be linked to their Facebook login data. Facebook transmits anonymized statistical data concerning the users of these pages to the operators of the site.
The ECJ recognized that the operator of a Facebook page is jointly responsible with Facebook for the processing of the personal data of the visitors to its page. The operator determines the purposes and means of the personal data processing of its website visitors through its parameterization:
36 In that context, it is apparent from the information submitted to the Court that. the creation of a fan page on Facebook implies, on the part of its operator, a parameterization according to, among other things, its target audience and the objectives of management or promotion of its activities, which has an impact on the processing of personal data for the purpose of compiling statistics based on the visits to the fan page. With the help of filters provided by Facebook, the operator can define the criteria according to which these statistics are to be compiled and even designate the categories of persons whose personal data are evaluated by Facebook. Consequently, the operator of a fan page maintained on Facebook contributes to the processing of the personal data of the visitors to his page.
37 In particular, the fan page operator may request demographic data about its target audience – and thus the processing of such data – such as, among other things, trends in age, gender, relationship status and professional situation, information about the lifestyle and interests of its target audience and information about the purchases and online purchasing behavior of visitors to its page, the categories of goods or services they are most interested in, as well as geographic data that informs it about where to carry out special promotions or organize events and, more generally, allows it to target its information offer as much as possible.
38 Although the visitor statistics generated by Facebook are transmitted to the Fan Page operator exclusively in anonymous form, the generation of these statistics is based on the prior collection – through the cookies set by Facebook on the computer or any other device of the persons who have visited this page – and the processing of the personal data of these visitors for these statistical purposes. In any case, Directive 95/46 does not require that, where several operators are jointly responsible for the same processing, each has access to the personal data concerned.
39 In those circumstances, it must be held that the operator of a fan page maintained on Facebook, such as the Academy of Economics, is involved in the decision as to the purposes and means of the processing of the personal data of the visitors to its fan page, by virtue of the parameterisation it carries out, inter alia, in accordance with its target audience and the objectives of controlling or promoting its activities. Therefore, in the present case, the operator is to be classified as a controller in the Union for the purposes of Article 2(d) of Directive 95/46, together with Facebook Ireland.
The question now is whether this decision also affects cases in which tools from social networks are used (social plugins such as the Like button or embedding videos, ads or pixels).