Case C‑210/16
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
v
Wirtschaftsakademie Schleswig-Holstein GmbH
(Request for a preliminary ruling from the Bundesverwaltungsgericht)
(Reference for a preliminary ruling — Directive 95/46/EC — Personal data — Protection of natural persons with respect to the processing of that data — Order to deactivate a Facebook page (fan page) enabling the collection and processing of certain data of visitors to that page — Article 2(d) — Controller responsible for the processing of personal data — Article 4 — Applicable national law — Article 28 — National supervisory authorities — Powers of intervention of those authorities)
Summary — Judgment of the Court (Grand Chamber), 5 June 2018
1. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Controller — Concept — Administrator of a fan page hosted on a social network — Included
(European Parliament and Council Directive 95/46, Art. 2(d))
2. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — National supervisory authorities — Powers — Investigative powers, powers of intervention and the power to engage in legal proceedings — Entitlement of the supervisory authority of a Member State to exercise those powers with respect to an establishment situated in the territory of that Member State — Belonging of an undertaking to a group which entrusted the responsibility for collecting and processing personal data to an establishment in another Member State — Irrelevant
(European Parliament and Council Directive 95/46, Arts 4 and 28)
3. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — National supervisory authorities — Powers — Powers of intervention — Exercise with respect to a third party responsible for processing personal data situated in another Member State — Competence to assess the lawfulness of the processing and to intervene without relying on the assistance of the supervisory authority of the other Member State
(European Parliament and Council Directive 95/46, Arts 4(1)(a) and 28(3) and (6))
1. Article 2(d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the concept of ‘controller’ within the meaning of that provision encompasses the administrator of a fan page hosted on a social network.
While the mere fact of making use of a social network such as Facebook does not make a Facebook user a controller jointly responsible for the processing of personal data by that network, it must be stated, on the other hand, that the administrator of a fan page hosted on Facebook, by creating such a page, gives Facebook the opportunity to place cookies on the computer or other device of a person visiting its fan page, whether or not that person has a Facebook account. In those circumstances, the administrator of a fan page hosted on Facebook, such as Wirtschaftsakademie, must be regarded as taking part, by its definition of parameters depending in particular on its target audience and the objectives of managing and promoting its activities, in the determination of the purposes and means of processing the personal data of the visitors to its fan page. The administrator must therefore be categorised, in the present case, as a controller responsible for that processing within the European Union, jointly with Facebook Ireland, within the meaning of Article 2(d) of Directive 95/46. The fact that an administrator of a fan page uses the platform provided by Facebook in order to benefit from the associated services cannot exempt it from compliance with its obligations concerning the protection of personal data. In those circumstances, the recognition of joint responsibility of the operator of the social network and the administrator of a fan page hosted on that network in relation to the processing of the personal data of visitors to that page contributes to ensuring more complete protection of the rights of persons visiting a fan page, in accordance with the requirements of Directive 95/46.
(see paras 35, 39, 40, 42, 44, operative part 1)
2. Articles 4 and 28 of Directive 95/46 must be interpreted as meaning that, where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State.
(see para. 64, operative part 2)
3. Article 4(1)(a) and Article 28(3) and (6) of Directive 95/46 must be interpreted as meaning that, where the supervisory authority of a Member State intends to exercise with respect to an entity established in the territory of that Member State the powers of intervention referred to in Article 28(3) of that directive, on the ground of infringements of the rules on the protection of personal data committed by a third party responsible for the processing of that data whose seat is in another Member State, that supervisory authority is competent to assess, independently of the supervisory authority of the other Member State, the lawfulness of such data processing and may exercise its powers of intervention with respect to the entity established in its territory without first calling on the supervisory authority of the other Member State to intervene.
(see para. 74, operative part 3)