Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH
The administrator of a fan page on Facebook is a joint controller with Facebook of the processing of visitors' personal data, even though it has no access to the data itself.
Facts
Wirtschaftsakademie, an education company, ran a fan page on Facebook to promote its services. Facebook placed cookies on the devices of visitors to the page, and used the data collected to compile anonymous statistics for the administrator about the visitors, and for its own advertising purposes. Visitors were not informed about this. The data protection authority for Schleswig-Holstein ordered Wirtschaftsakademie to deactivate its fan page. Wirtschaftsakademie argued that it was not responsible for the processing carried out by Facebook, and the German court referred questions to the Court of Justice.
Legal principle
The Court of Justice held that the administrator of a fan page was a controller, jointly with Facebook, of the processing of the personal data of visitors to the page. By creating the page and defining the parameters for the statistics, for example by reference to the target audience, the administrator took part in determining the purposes and means of the processing. The fact that it received only anonymised statistics and had no access to the personal data did not matter. Joint responsibility did not mean equal responsibility, and the degree of responsibility of each controller depended on the circumstances. The broad definition of controller was intended to ensure effective and complete protection of data subjects.
Related cases on personal data, controllers and the scope of data protection
- Breyer v Bundesrepublik Deutschland (2016) Case C-582/14
- Durant v Financial Services Authority [2003] EWCA Civ 1746
- Fashion ID GmbH & Co KG v Verbraucherzentrale NRW eV (2019) Case C-40/17
- Lindqvist (2003) Case C-101/01
- Nowak v Data Protection Commissioner (2017) Case C-434/16
- Ryneš v Úřad pro ochranu osobních údajů (2014) Case C-212/13
Studying data protection and technology law? Our tutors help you understand and apply cases like this in essays, problem questions and exams. Request a quote or browse our law notes.
This summary is for study and revision and is not legal advice. Although our case summaries are checked for accuracy, we do not guarantee that they are free from errors or omissions. Always read the full judgment for the court's reasoning.
