Installing Facebook 'Like' Button Makes Website Joint Controller, Says Advocate General

On 19 December 2018, Advocate General Bobek ("AG Bobek" or the "AG") delivered his opinion in case C-40/17, Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV. The AG argued that the operator of a website integrating a third party plugin such as the Facebook "Like" button, which causes the collection and transmission of the users' personal data, is jointly responsible for that stage of the data processing.

Fashion ID, a German online retailer, integrated the Facebook "Like" button into its website. As a result of the functionality of the Facebook "Like" button, information about a user's IP address and browser string is transferred to Facebook Ireland. This occurred automatically when Fashion ID's website was loaded, regardless of whether the user has a Facebook account or whether he or she clicked on the "Like" button. Verbraucherzentrale NRW, a German consumer protection association, filed for a cease-and-desist injunction against Fashion ID on the ground that the use of the Facebook "Like" button results in a breach of data protection legislation.

At issue is the interpretation of several provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR"). The Düsseldorf Higher Regional Court asked the Court of Justice of the European Union ("ECJ") whether an online retailer who integrates the Facebook "Like" button into its website is a data controller of the relevant data processing.

Pursuant to Article 26(1) of the GDPR, several parties involved in data processing are to be considered as "joint controllers for data processing" when jointly determining the purposes and means of data processing. In order for joint controllers to be responsible, each party involved must have actual influence. On 5 June 2018, the ECJ already held that there was joint controllership between Facebook Ireland and the operator of a so-called...