European Court of Justice (ECJ): Facebook fanpages will be treated as a case of Joint Control

With its judgment of June 5 2018, the ECJ decided that both the initiator of the fan pages (e.g. a company) and Facebook are jointly responsible in terms of the General Data Protection Regulation (GDPR) for the personal data collected within the scope of Facebook fan pages.

Fanpages are a Facebook profile of a company that can be used to easily communicate with customers.

Until now, information has been collected from customers who have contacted a company via Facebook. Depending on the type of use of the fan pages, the name and profile of the customer were stored. Facebook has also passed on information collected from users via tracking tools to the respective initiators of the fan pages. In the opinion of the ECJ, the affected users of the respective fan pages were not sufficiently informed about this fact, so that the following requirements must be observed in future:

Who visits a fan page must be informed about which data is collected for which purposes.

In consultation with Facebook, fan page operators must have their own knowledge of what data are collected in order to be able to inform them. This information is obligated pursuant to Art. 13 and 14 of the GDPR.

Before tracking tools and cookies are used, consent must be obtained.

Furthermore, companies and Facebook must become aware of their shared responsibility. It is not yet clear whether this will be done with a contract pursuant to Art. 26 GDPR on Joint Control or with an order data processing agreement pursuant to Art. 28 GDPR. Another solution may also be found.

However, this judgement will not only have consequences for Facebook, but will also affect all social media platforms. This not only affects companies that have their own company presence on Facebook, but also platforms such as LinkedIn, Twitter, Google+ etc., provided that similar tracking functions or other data surveys offer or are included.