No fans of fan pages - data protection authorities may prohibit operation

In a clarifying ruling, the Federal Administrative Court further defined the responsibilities involved in operating Facebook fan pages. The pending case concerned an administrative act by the Independent State Center for Data protection Schleswig-Holstein (ULD) against the operator of a Facebook fan page. The ULD had already prohibited the operator from operating the fan page in 2013 because Facebook was collecting an unspecified amount of data on it. The operator initially successfully challenged the order to deactivate the page.

Following a referral of this case by the Federal Administrative Court, the European Court of Justice (ECJ) ruled as early as 2018 that operators of Facebook fan pages bear joint responsibility under data protection law (see news item dated June 6, 2018), since, by operating the fan page, they create the incentive for data subjects to visit Facebook and thus form the basis for the data processing.

The binding ruling by the European Court of Justice has now led to a ruling by the Federal Administrative Court. The Federal Administrative Court has remanded the case to the lower court, the Higher Administrative Court of Schleswig-Holstein.

What is interesting about the decision is that, in its ruling, the Federal Administrative Court expressly endorsed the option of prohibiting the operation of the fan site as an effective means of ensuring data protection. The ULD’s deactivation order, which was the subject of the challenge, was proportionate in this case.

Furthermore, the Federal Administrative Court clarifies that regulatory authorities may base their selection of the party responsible for the infringement heavily on considerations of effectiveness. The supervisory authorities may contact the operator of the fan page directly—even though the operator has no influence whatsoever over Facebook’s data collection—and are not required to first contact Facebook or its subsidiaries in other countries.

It will be interesting to see how data protection authorities position themselves in the near future with regard to public and private operators of Facebook fan pages.

One thing is certain: Fan page operators should familiarize themselves with data processing on their fan pages to the best of their ability.

If you are unsure how to handle your own fan page, we will be happy to advise you.

from J. Baeck

Further information: bverwg.de/pm/2019/62