The Court of Justice of the European Union has ruled (case No. C-40/17), Monday, July 29, that an online merchant should be held jointly responsible for the processing and collection of personal data obtained through Facebook’s "Like" button. This approach requires them to inform the user and obtain consent for the extraction of data concerning both the social network and the merchant.
The Court thus confirms the Opinion of the Advocate General in this case between the German consumer protection association, Verbraucherzentrale NRW and the online fashion retailer, Fashion ID (see EUROPE 12305/5). The problem stems from that Fashion ID had embedded a plugin on its page, the Facebook "Like" button, which allows the social network to obtain the personal data of visitors to its website (information about their IP address and browser string) and to install cookies on their device.
In its judgment, the Court considers that Fashion ID and Facebook Ireland jointly determine the means and purposes of data collection and transmission (even if the company claims not to have been informed of the implications of the "Like" button on its page). The judges affirm that these processing operations appear to be carried out in the economic interests of both parties, the embedding of such a button allowing Fashion ID to optimise the publicity for its products by making them more visible on the Facebook social network when a visitor to its website clicks on the said button.
In conclusion, the Court considers that Fashion ID must provide, at the time of data collection, certain information to its customers, such as its identity and the purposes of the processing, and must obtain prior consent (only) for the operations for which it is (jointly )responsible, namely the collection and transmission of the data. It specifies that the joint responsibility does not extend to the further processing of this data, carried out solely by Facebook. See the judgment on page: https://bit.ly/2Yc717S (Original version in French by Sophie Petitjean)