Court Of Justice Of European Union Holds That Administrator Of Facebook Fan Page Is Controller

On 5 June 2018, the Court of Justice of the European Union (the "ECJ") delivered a judgment in response to a request for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Germany - the "Court") concerning the interpretation of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Directive") (ECJ, 5 June 2018, case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH).

The case concerned a fan page hosted on Facebook by Wirtschaftsakademie Schleswig-Holstein GmbH, a company operating in the field of education ("Wirtschaftsakademie"). The Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (the supervisory authority within the meaning of Article 28 of the Directive, with the task of supervising the application of data protection rules in the German Bundesland of Schleswig-Holstein (Germany), the "ULD") ordered Wirtschaftsakademie to deactivate the fan page it had set up on Facebook. According to the ULD, this processing was illegal since neither Wirtschaftsakademie nor Facebook had informed the fan page visitors that Facebook collected personal data concerning them through the use of cookies.

Wirtschaftsakademie challenged that decision, arguing essentially that it was not responsible under data protection law for the processing of the data by Facebook or the cookies which Facebook installed. In a judgment of 9 October 2013, the Verwaltungsgericht (Administrative Court) annulled the challenged decision. The ULD appealed to the Oberverwaltungsgericht (Higher Administrative Court), but the Oberverwaltungsgericht dismissed the ULD's appeal against the judgment. Finally, the ULD appealed to the Court which then decided to stay the proceedings and refer a number of questions to the ECJ for a preliminary ruling.

The ECJ held that the concept of "controller" in the Directive must be interpreted...