On 9 March 2016 the Düsseldorf Regional Court in Germany ruled that an online shopping site, Peek & Cloppenburg, which integrated Facebook’s “like” button into its website had violated users’ privacy rights.
How the “like” button works
The button allows website users who click on it to share instantly the pages and content from the website on their Facebook profiles. This technology is a rapidly-growing marketing tool.
Although the German case related to the Facebook “like” button, it applies equally to other social media buttons, such as those used for LinkedIn, Twitter and Google+, all of which result in similar data transfers.
Finding of the Court
Having found that the IP addresses amounted to personal information and that the transfer of IP addresses to Facebook was not necessary for the functioning of the website, the court found that Peek & Cloppenburg violated German data privacy laws when it integrated the button into its website.
The court held that the link to a data protection statement at the bottom of the website could not save the business’ defense. The court held that the link was insufficient to constitute an indication that data was being, or would be, processed.
The court found against Peek & Cloppenburg because the personal information of users was sent to Facebook without the user’s prior, express consent or approval and there was no method of revoking the data transfer. The court ruled that users should have consented and been informed of what personal information was being processed and the purpose of the processing.
A South African take
Although the Protection of Personal Information Act, 2013 (POPI) is not yet fully in force, POPI has similar requirements to inform data subjects (in this case, the website users) of the personal information being processed and the purpose of the processing, and to obtain their consent to processing.
The website owner will likely be a “responsible party” under POPI because the owner determines the purpose, and means, of processing the personal information, namely allowing the integration of the button on the website to transmit information to Facebook regardless of the fact that the transmission occurs automatically.