Privacy & Cybersecurity Law Blog

On January 14, 2015, the data protection authority of the German federal state of Schleswig-Holstein (“Schleswig DPA”) issued an appeal challenging a September 4, 2014 decision by the Administrative Court of Appeals, which held that companies using Facebook’s fan pages cannot be held responsible for data protection law violations committed by Facebook because the companies do not have any control over the use of the data.

The Schleswig DPA claimed that because companies create the fan pages, they are responsible for the data collected and processed by Facebook through the fan pages for purposes such as behavioral advertising. The Schleswig DPA also alleged that the court failed to (1) examine Facebook´s business model, (2) assess technical details related to the functioning of fan pages, and (3) consider the social use of fan pages. The Schleswig DPA argued that the Court of Appeals is in an appropriate position to rule and review decisions of lower courts only after it addresses the three issues above. In addition, the Schleswig DPA stated that Facebook´s business model violates a number of provisions in the German Telemedia Act, including the sections related to user profiling. The Schleswig DPA also suggested that if the court does not concur with the Schleswig DPA’s interpretation of EU data protection law regarding data controllership on social networking websites, the case should be referred to the European Court of Justice (“ECJ”) for a preliminary ruling. An ECJ preliminary ruling is a decision regarding the interpretation of European Union law at the request of a EU member state court.