In his conclusions in Case C-210/16 on Tuesday 24 October, Advocate General Yves Bot stated that a national data protection authority can ask Facebook or the owner of a fan page to deactivate this page if its visitors are not informed that their personal data are being collected.
Fan pages are configured Facebook accounts that are used, amongst other things, to promote products for commercial purposes. The administrators of these pages can use tools supplied available by Facebook to obtain statistics concerning the age, sex, characteristics or habits of visitors to these pages, to better target their communication through cookies.
In 2011, the regional data protection authority of Schleswig-Holstein asked a company to close down its fan page on penalty of a fine, as neither the company in question nor Facebook had notified users about data collection practices. The German company then appealed against this decision, arguing that it was not responsible for the processing of Facebook's data or cookies.
The German court to which the case had been brought entered a request for a preliminary ruling, to find out whether it was possible to ask Facebook or the owner of a fan page to take down a page over missing information concerning data collection.
In his conclusions, Advocate General Bot argued first of all that Facebook and the page owner were jointly responsible for the treatment of personal data.
He then observed that Facebook has an establishment in Germany and as the data in this particular case are processed in Germany, German law on the processing of personal data applies and the German control authority is therefore competent. However, he considers that it is Facebook Ireland, rather than Facebook Germany, that should be the subject of a data collection ban, as it is exclusively responsible for the processing of personal data in the EU. Furthermore, he considers that the competence of the German authority may be exercised autonomously, without recourse to the Irish authority.
Lastly, Bot considers that a prohibition measure targeting a fan page owner is possible, to ensure the fullest possible protection for citizens. (Original version in French by Lucas Tripoteau)