CJEU Judgment In The Fashion ID Case: The Role As Controller Under EU Data Protection Law Of The Website Operator That Features A Facebook 'Like' Button

On July 29, 2019, the Court of Justice of the European Union ("CJEU") issued its judgment in Case C-40/17 (Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV). This is a landmark decision regarding the assessment of who has the responsibility for complying with data protection legislation in the context of embedding third-party features that regularly takes place on websites.

The CJEU adopted a broad view of the situations in which a "joint controllership" can arise. It held that, under EU data protection legislation, the operator of a website featuring the Facebook 'Like' button (a social plugin that causes the transmission to Facebook of website users' personal data) can qualify as a controller, jointly with Facebook. Consequently, the website operator is directly responsible for complying with legal obligations in this respect, including by informing its users that their personal data will be transferred to Facebook.

However, the CJEU importantly clarified that the website operator's role as controller (and the corresponding legal obligations) is limited to the collection and transmission of the data to Facebook and does not include any subsequent personal data processing that Facebook carries out.

The CJEU's findings will potentially affect third-party technologies other than the Facebook 'Like' button, which are often incorporated into websites, such as cookies and pixels.

1. The Facts

   Fashion ID is an online retailer whose website featured the Facebook 'Like' button, which allowed visitors of the website who are Facebook users to "like" articles and post them on Facebook's social network.

   The existence of this plugin entails that, every time a visitor consults the website, his or her personal data (namely, information concerning his or her IP address and browser string) is transmitted to Facebook, which also places different kinds of cookies on the visitor's device. Notably, this data processing occurs regardless of whether the visitor is a member of the social network or has clicked on the 'Like' button.

   Verbraucherzentrale NRW, a German consumer protection association, brought a lawsuit against Fashion ID on the ground that the use of that plugin results in a breach of data protection legislation. Verbraucherzentrale NRW claimed that transmission to Facebook of visitors' personal data occurred without the data subjects' consent and in breach of the duties to inform set out in legislation on the protection of personal data.

   The Düsseldorf Higher Regional Court requested a preliminary ruling of the CJEU, seeking the interpretation of EU data protection legislation. In light of the date of the facts in the dispute in the main proceedings, Directive 95/46/EC applies, albeit having been repealed and replaced by Regulation (EU) 2016/679 ("GDPR") as of May 25, 2018.

   The core question among those posed by the referring court was whether Fashion ID must be classified as a controller with regard to the data processing taking place, and if so, how the individual obligations imposed by EU data protection legislation are to be met in such a scenario.

2. The Findings of the CJEU

   The CJEU noted that, under EU data protection legislation, a natural or legal person is a controller only in respect of operations involving the processing of personal data for which it determines the purposes and means. By contrast, that natural or legal person cannot be a controller in the context of operations that precede or are subsequent in the overall chain of processing and for which that person does not determine either the purposes or the means.

   In light of the above, the CJEU found the following:

   i. By embedding on its website the Facebook 'Like' button, Fashion ID made it possible for Facebook to obtain personal data of visitors to its website and was capable of determining, jointly with Facebook, the purposes and means of this data processing. Therefore, Fashion ID is to be regarded as a controller, jointly with Facebook, with respect to the activity consisting of this collection of...