The Advocate General to the Court of Justice of the European Union (CJEU) Yves Bot caused a sensation with his unexpected opinion concerning the admissibility of social media fanpages under EU data protection law. According to the opinion of Mr. Bot, the operator of a social media fanpage is “jointly responsible for the processing and collection of personal data together with” the social media operator.

Further, the operator of a fanpage of a social network is deemed to be a controller “with regard to the phase of processing of personal data consisting in the collection of data on the persons visiting this site by this social network with a view to the production of visitor statistics relating to this site.”

The proceeding

The core issue of the opinion is the question whether a company can operate a social media fanpage without having to worry about the social media operator’s compliance with privacy laws. The CJEU is expected to reach its final decision in a few months’ time.

The opinion is based on an order of the Independent Regional Centre for Data Protection Schleswig-Holstein (ULD) against the fanpage of the Wirtschaftsakademie Schleswig-Holstein from 2011 due to data protection violations. The matter was ultimately referred to the CJEU.

In proceedings before the ECJ, the Advocate General shall, after the oral hearing, draw up a proposal for a decision of the CJEU in complete impartiality and independence, taking into account the case-law to date.

Our take

According to the Advocate General’s view, the operator has a decisive influence on processing of personal information and also has the power to terminate it by closing the fanpage. The Advocate General sees no fundamental difference between the case of a fanpage operator and the operator of a website which incorporates the code of a web tracking service provider and thus supports the setting of cookies and data collection in favor of the web tracking service provider.

This opinion would constitute a very broad interpretation of responsibilities for data processing activities and could potentially lead to a liability for other operator of online-subpages.

Even though the CJEU is not bound by the Advocate General’s opinion, the CJEU often follows these opinions in essential points. Companies should closely monitor the final decision by the CJEU and align their social media marketing accordingly.