CJEU, judgment of 5 June 2018, C-210/16, Wirtschaftsakademie Schleswig-Holstein

The CJEU (Grand Chamber) held that the operator of a Facebook fan page is jointly responsible with the network for the processing of visitors' data. The decision was still handed down under the earlier Data Protection Directive 95/46/EC, but its principles continue to apply to Article 26 GDPR.

1. Facts

The Wirtschaftsakademie Schleswig-Holstein, a private education provider, operated a fan page on the social network Facebook. When the page was accessed, Facebook collected data of the visitors by means of cookies, including data of visitors without a Facebook account of their own, and made anonymized usage statistics available to the operator on that basis. The competent supervisory authority, the Independent State Center for Data Protection of Schleswig-Holstein, ordered the Wirtschaftsakademie to deactivate the fan page because the visitors were not informed of the collection of their data. It was in dispute whether the fan page operator was jointly responsible for that processing.

2. Decision

2.1 Joint controllership of the fan page operator

The Court classified the fan page operator as a joint controller together with the network. By setting up the page, the operator enables the network to collect the visitors' data. At the same time, the operator takes part in determining the means, because it has a say in the parametrization of the statistics functions, whose collection it triggers and uses to its own advantage.

2.2 No equivalent participation, no access to the data required

Joint controllership does not presuppose that all those involved decide on the processing to the same extent. Controllership may take different forms. It is likewise immaterial that the fan page operator receives only anonymized statistics and has no access to the personal raw data. What is decisive is the influence exerted on the processing, not access to the data.

3. Significance for practice

The judgment is the landmark decision on the broad interpretation of joint controllership:

• Anyone who, through decisions of their own, enables and influences another party's data processing may be a joint controller.
• Equivalent participation is not required; the contributions may carry different weight.
• Access to the data is not a precondition of controllership.
• The reasoning extends beyond fan pages to other forms of technically interlinked processing (such as embedded tools and plugins).