The Judgment of the Court of Justice of the European Union (CJEU) of July 29, 2019 indicates that the administrator of a website that inserted the “Like” module of Facebook, is considered joint controllership of the processing in the operation of collection and transmission of personal data of the user. Button that implies an automatic transmission of the user’s personal data to the social network.
Fashion ID, a clothing e-commerce company, introduced the Facebook “Like” button on its website. This implies that when a user enters their page, personal data of the user is automatically transmitted to this social network: the user’s IP address and the user sequence, among other data. The transmission takes place without the visitor being aware of it and regardless of whether the visitor is a member of Facebook or has clicked on the “Like” button. This collection and communication of personal data takes place without any consent from the users, who are not given any information regarding the collection and processing of their personal data.
Faced with this situation, in March 2016, a German consumer association filed a cease and desist action against Fashion ID at the Higher Regional Civil and Criminal Court in Düsseldorf, Germany. The High Court decided to stay the proceedings and consult the European Union Court of Justice on whether Fashion ID was responsible for the processing of personal data by a third party hosted on its website.
In this sense, Fashion ID argues that it is not responsible for the collection and processing of personal data by a third party on its website. It argues that it has no ability to determine what data the browser transmits or what the external provider does with that data, in particular if it decides to store and/or analyse it.
However, the Court of Luxembourg considers that Fashion ID is jointly responsible with Facebook for the collection and communication of personal data, even if that data is not available for the former. Due to the fact that the website by letting you incorporate external links to Facebook on your page allows you to collect and process the data in return for a consideration (increased advertising) and therefore for mutual benefit. Thus influencing the processing of the data according to their own objectives. Therefore, the two companies jointly determine the purposes (optimizing the advertising of Fashion ID products on the social network) and the means (the insertion of the “Like” button). The Court considers that Fashion ID’s liability will not be linked to the further processing of the data by Facebook. It limits itself to the “first part” of the processing chain, i.e. the collection.
Like many other websites, Fashion ID is responsible or co-responsible, even if only for “that first part of the chain”, for the processing and collection of data that may be carried out by third parties on their web domains to which it has allowed them to install external links that allow them to collect personal data of users. This co-responsibility, although diffuse in practice, enables the interested party to address either one or the other in the exercise of their legitimate interests. The interested party may never have suspected all the implications that access to a website with external links from third parties could entail.