On Joint Controllership for Social Plugins and Other Third-Party Content – a Case Note on the CJEU Decision in Fashion ID

Abstract

In its decision in Fashion ID, the Court of Justice of the European Union (CJEU) assessed the responsibilities pertaining to the processing of personal data through a Facebook “Like” button embedded in a third-party website. The decision, which was not directed at Facebook Ireland, but at a comparatively small German online clothing retailer embedding the social plugin, reaffirms the preference of (German) authorities and consumer protection associations to regulate Facebook indirectly, i.e. through decisions directed against Facebook’s partners, which is seemingly the more feasible way. In the decision, the CJEU concluded that the website operator, and Facebook Ireland as the plugin provider are jointly responsible merely for the collection of personal data and its disclosure by transmission to Facebook Ireland, whereas the subsequent data processing operations fall under the sole responsibility of Facebook Ireland. This case note argues that this delineation does not sufficiently consider the technical reality behind such plugins. Further, it argues that the CJEU seems to have relied predominantly on the criterion of decisive (factual) influence on data processing, thereby departing from its previous case law. The CJEU further ruled that should joint data processing be based on webpage visitors’ consent, the latter has to be collected by the webpage operator. This solution creates a significant additional administrative burden for the involved companies. According to this case note, the decision on such a technical matter should rather have been left to the disposition of the companies.