In a decision which is making waves, the Court of Justice of the European Union (the "Court"), on 5 June 2018, ruled that administrators of fan pages on social networks may be considered as "joint controllers", along with the companies responsible for those social networks, regarding the processing of personal data of social network users which may be carried out via those pages.
Though based on the now repealed Data Protection Directive, the similarities between the provisions of the Directive assessed and those found in the GDPR mean that the decision maintains relevance in the current framework.
Administrators of fan pages on Facebook are able to obtain anonymous statistical information on fan page visitors - whether or not these visitors have a Facebook account - by means of the "Facebook Insights" service. This service automatically places "cookies" (i.e., small text files) onto devices used by visitors, containing a unique user code, which can be read and matched to those users by Facebook. The resulting information (which is considered as "personal data") is used to provide aggregated statistics to fan page administrators, and also to enable Facebook to improve its ability to target advertisements over its network.
The Court's decision results from the actions of the German supervisory authority for the Land of Schleswig-Holstein, which issued an order against Wirtschaftsakademie Schleswig-Holstein GmbH - an administrator of a Facebook fan page - to deactivate the fan page set up. The reasoning for this order was that neither the administrator nor Facebook informed visitors that this processing would occur. The administrator contested this, essentially maintaining that it should not be considered a controller in relation to processing carried out solely by Facebook. The matter was brought before the German courts, culminating in a referral to the Court of Justice of the European Union.
Advocate-General Bot, in his Opinion, stated that the decision to create and operate a fan page on Facebook is what triggers this data processing, and that administrators can decisively influence the termination of this processing, by deactivating the fan page. The Court noted that merely making use of a social network would not suffice to render the user a joint controller regarding the processing of personal data by that network; however, by creating a fan page and relying on "Facebook Insights", the administrator effectively...