The operator of a website that has embedded Facebook’s ‘Like’ button is jointly responsible for the collection and processing of personal data transmitted to the American giant, said Advocate General Michal Bobek in the conclusions reached on Wednesday 19 December (Case C-40/17).
Fashion ID, a company that sells fashion items online, has embedded Facebook's ‘Like' button on its website. When a user lands on the company's website, information about their IP address and browser string is automatically transmitted to Facebook, irrespective of whether they have clicked on the button and whether or not they have a Facebookaccount.
After the German consumer protection association Verbraucherzentrale NRW brought legal proceedings, the German courts are asking the European Court of Justice to interpret several provisions of the Directive (95/46) on the protection of personal data which applies to this case, although it has since been repealed by the General Data Protection Regulation (‘GDPR’) (2016/679).
In his Opinion, the Advocate General proposes to the Court of Justice to rule that, under the Directive, the operator of a website that has embedded a plug-in (such as Facebook’s ‘Like' button), which collects and transmits a user's personal data, is jointly responsible for processing that data.
This joint liability is limited only to operations for which it is effectively co-decision maker on the purposes and means of the processing of the personal data. It does not include the previous or later phases of the chain of processing for which the operator of the site does not determine the purposes or means of the data processing.
According to Mr Bobek, subject to verification, it appears that Fashion ID and Facebook Ireland are jointly responsible for the phase of collecting and transmitting data from users of the fashion retail site due to the commercial purpose that unites the two companies.
The Advocate General recalls that the processing of personal data without the consent of users is possible if three cumulative conditions are met: - the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; - the need to process personal data for the purposes of the legitimate interest pursued, and; - the condition that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence.
In this respect, the Advocate General proposes to the Court to rule that the legitimate interests of Fashion ID and Facebook Ireland have to be balanced against the rights of the users of the website. Where applicable, these users will have to give their explicit consent to the operator of the website, who will be required to inform them about the use of their data. (Original version in French by Mathieu Bion)