Leipzig, Berlin The operators of commercial fanpages on Facebook are responsible for the collection of user data in the background. In the case of serious data protection deficiencies, data protectors may therefore oblige the operators to switch off the company side. This was decided by the Federal Administrative Court in Leipzig on Wednesday. (Az .: BVerwG 6 C 15.18)
Schleswig-Holstein's data protection officer Marit Hansen, whose house had set the pattern case rolling, welcomed the decision and called on the US Internet company to act on. Data privacy compliance is “not nicety, but a must,” said Hansen the Handelsblatt. “Here I expect that Facebook moves.” Fanpages would be “conceivable as a tracking-free zones in which no data on the users are collected,” said Hansen. “In any case, however, more transparency is needed so that it becomes understandable and verifiable which data is processed on which legal basis and how.”
Hansen sees after the “clear” decision of the Leipzig judges also the operator of fan pages in the duty. “Every organization, whether company or agency, that wants to run Facebook fan pages, is now required to demand from Facebook the data protection compliance for the operation of these fanpages related data processing,” said the data protection officer. Because after the decision of the Supreme Court, these organizations are in terms of fan pages “jointly responsible with Facebook”.
The procedure has been employing the judiciary for years. It is still based on the old legal situation before the introduction of the General Data Protection Regulation (GDPR). The Independent Center for Data Protection (ULD) demanded in 2011 from the Wirtschaftsakademie Schleswig-Holstein the deactivation of the fan page. When the page was accessed, users' data would be collected without being informed. The Academy, an educational company of the Chambers of Industry and Commerce (IHK), bears a data protection responsibility – even if the technical infrastructure is entirely from Facebook.
The business academy filed a lawsuit against the decision and got right first. The Higher Administrative Court (OVG) Schleswig-Holstein saw no co-responsibility of the site operators for data processing. The Federal Administrative Court finally brought the case before the European Court of Justice – and decided in 2018 that Fanpage operators were to be classified as responsible for the data processing. The Leipzig judges are now committed to this assessment.
Criticism from the economy
The Business Academy had argued that it would be imposed on data processing. “The data processing is done by Facebook. As a site operator, I can hardly resist that this happens, “said the school's lawyer at the hearing.
The federal judges, however, classified the fan page operators as “door openers” for the data collection. “It is sufficient that a contribution for the purpose of data collection and processing is made,” said the presiding judge of the 6th Senate, Ingo Kraft. Even though Facebook itself is also considered as an addressee for the complaints, the privacy advocates could have turned to the page operators for reasons of effectiveness.
To what extent the data processing in this specific case was actually unlawful, but still needs to be clarified more precisely, judged the Leipzig judges. They therefore referred the case back to the OVG for a new hearing and decision. Hansen sees that calmly. “This means no restriction for the present and the future, because anyway, now the entire data processing on the basis of the new legal situation, namely the General Data Protection Regulation, to examine,” she said.
Martin Wansleben, Managing Director of the Association of German Chambers of Industry and Commerce (DIHK), explained that legal uncertainties regarding data protection on social media channels have unsettled many companies. The presences on Facebook & Co are important for maintaining customer relations. “Legal conflicts between data protection authorities and individual social media providers, however, should not be carried out on the backs of the vast majority of well-behaved companies in Germany,” said Wansleben.
Data protector Hansen said the verdict was a warning shot on Facebook. Her house will now check whether there are newer data protection violations. Complaints were submitted and would be examined. “I expect Facebook to draw conclusions from the verdict,” said Hansen.
More: Competition experts recommend to the federal government a sharp regulation of data-rich digital companies. The industry is alarmed.
Facebook (t) Privacy (t) Fanpages (t) Leipzig Federal Administrative Court (t) judgment (t) Internet portal (t) Internet (t) data protection infringement (t) legal area (t) jurisdiction-Internet (t) Federal Administrative Court (t) Berliner Verkehrsbetriebe (t) DIHK (t) Marit Hansen (t) Martin Wansleben