EuGH poses new challenges to Facebook Fan page operators
The Fan page judgement is a milestone for online responsibility.
The BvD e.V. [Association of Data Protection Officers of Germany]in principle welcomes the judgement of the European Court of Justice (EuGH) holding Facebook Fan page operators and Facebook jointly responsible under data protection laws for social service user data collected on their pages. This is a milestone in terms of the clarification of responsibility under data protection law in general under online circumstances.
Website operators will, however, now face new challenges and risks they will not easily be able to resolve. We trust that supervisory authorities will, as in the past, respond with sound judgement and at first simply explain the consequences. The judgement does, in fact, contribute to the coercion of platforms such as Facebook to take data protection more seriously. The dispute should, however, not be carried out at the cost of users simply because adequate action against operators is hard to enforce.
The EuGH ruled on Tuesday that the operators of so-called Facebook Fan pages and Facebook would be held jointly responsible for Fan page visitor data collected by the social service. The Court held that Fan page operators also have a hand in decisions concerning the purpose and means of processing personal data. Fan page operators could, among other, obtain data on lifestyles and interests of specific target groups, on the online purchasing behaviour of visitors to the pages and on geographical data. Page operators could use this information for specific advertising campaigns or events.
This may in practice –at least initially – lead to many companies and individuals closing their Fan pages, pending response from Facebook. The judgement could also have an effect on tracking tools and social plug-ins used by many webpage operators. Overall, the decision has the potential for massive change where analysis tools are used on the Internet. This has its dark sides and bright. Affected persons are better protected but the users of such applications are faced with challenges that will not be easy and quick to resolve.
The decision of the EuGH was triggered in November 2011 by a ruling against the Private Economic Academy Schleswig-Holstein by the Independent Centre for Privacy Protection Schleswig-Holstein (ULD). The educational institution was instructed to deactivate its Facebook Fan page because visitors to the page had not been informed that Facebook was collecting their personal data, their surfing behaviour and their interests via Cookies for purposes of “behavioural web tracking”.
The economic academy instituted legal proceedings before the administrative court and later before the higher administrative court. The ULD then took the matter to the Federal Administrative Court that referred it to the EuGH. The judges then in addition ruled that the ULD could take action not only against the economic academy but also against Facebook Germany.
Author: Kai-Uwe Loser, BvD Chairman of the Board