The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page, the Court of Justice of the European Union (CJEU) has recently concluded.
The right of an individual to have his or her personal data protected is clearly enshrined within the EU’s legal system. The recently enacted General Data Protection Regulation, commonly known as GDPR, and its predecessor, the EU Directive on data protection, ensure that the data relating to an individual is treated with the utmost respect and safeguarded against abuse.
The facts of this case were briefly as follows. A German company offers educational services inter alia by means of a fan page hosted on Facebook. Administrators of fan pages can obtain anonymous statistical data on visitors to the fan pages via a function called ‘Facebook Insights’ which Facebook makes available to them free of charge under non-negotiable conditions of use.
The German data protection supervisory authority ordered the German company to deactivate its fan page. According to the authority, neither the company nor Facebook informed visitors to the fan page that Facebook, by means of cookies, collected their personal data and processed it.
The company appealed from the decision before the German administrative courts, arguing that the processing of personal data by Facebook could not be attributed to it. Furthermore, it affirmed that it had not commissioned Facebook to process data that it controlled or was able to influence. The German company alleged that the authority should have acted directly against Facebook rather than against it. A preliminary ruling regarding the interpretation of EU law on data protection to the facts at hand was sought by the German courts.
The CJEU observed that it was not disputed that the American company Facebook and, for the EU, its Irish subsidiary Facebook Ireland must be regarded as controllers. As controllers, these companies are responsible for processing the personal data of Facebook users and persons visiting the fan pages hosted on Facebook. It is these companies which primarily determine the purposes and means of processing such data, the court maintained.
An administrator cannot be exempted from compliance with data protection obligations
However, the CJEU continued to note that, an administrator of a fan page must be regarded as a controller jointly responsible with Facebook for the processing of such data. Such an administrator takes part, depending in particular on its target audience and the objectives of managing or promoting its own activities, in the determination of the purposes and means of processing the personal data of the visitors to its fan page.
In particular, the court observed that the administrator of the fan page can ask for and process demographic data in anonymised form, concerning its target audience. Such data includes trends in terms of age, sex, relationships and occupations, information on the lifestyles and interests of the target audience such as information on the purchasing habits of visitors to its page, as well as the categories of goods or services that appeal the most and geographical data. Such data tells the fan page administrator where to make special offers and organise events and more generally enable it to target best the information it offers.
The court affirmed that despite the fact that an administrator of a fan page uses the platform provided by Facebook in order to benefit from the associated services, it cannot be exempted from compliance with data protection obligations. The acknowledgement of joint responsibility of the operator of the social network and the administrator of a fan page hosted on that network in relation to the processing of the personal data of visitors to the fan page, ensures a more complete protection of the rights of individuals visiting the page.
With the recent coming into force of stronger rules regulating the protection of data of individuals, accompanied by heftier fines for any breach of such rules, it is indispensable that there is the utmost clarity where responsibility lies. Such judgments serve to provide legal certainty in an area of law which is not only sensitive but also of high commercial importance.
Mariosa Vella Cardona is a freelance legal consultant specialising in European law, competition law, consumer law and intellectual property.
law.mariosa@vellacardona.com