\n
![](\"https:\/\/i0.wp.com\/rsoftsolution.com\/blog\/wp-content\/plugins\/RSSPoster_PRO\/cache\/7f339_6374031629_a8aa1e79de_b.jpg?w=640&ssl=1\")
<\/p>\n
\n<\/p>\n
Facebook\u2019s European business may not, for too much longer, be able to rely on its preferred privacy buffer of arguing that data protection oversight of its business is exclusively limited to the Irish watchdog on account of its European HQ being located in Ireland.<\/p>\n
A non-binding legal opinion put out today by an influential advisor to Europe\u2019s top court has ruled that the social network can in fact be subject to privacy oversight in other European Union Member States \u2014 at least where it has some physical presence (such as a sales office), as well as users whose data it is gathering for targeted advertising.<\/p>\n
The underlying case pertains to the background tracking of web browser users via Facebook operated cookies. A German education and training company which runs a fan page on Facebook had, in 2011, been ordered by a German data protection authority to deactivate the Facebook page\u00a0because the latter deemed that neither it nor Facebook had informed users their personal data was being collected.<\/p>\n
The company challenged the order in court and, after much legal back and forth, several questions were referred to Europe\u2019s top court for a preliminary ruling \u2014 which today\u2019s advocate general opinion prefigures.<\/p>\n
In recent years, various European DPAs have sought to impose fines on Facebook for what they view as data protection violations pertaining to users in their jurisdiction, including watchdogs in\u00a0Spain<\/a>, the Netherlands<\/a> and\u00a0Belgium<\/a>.<\/p>\n But Facebook\u2019s go-to rebuttal is to claim it is only subject to the jurisdiction of the Irish DPA.<\/p>\n In today\u2019s opinion, the advocate general writes: \u201cIn recent months, the supervisory authorities of several Member States have decided to impose fines on Facebook, because of breaches of the rules on the protection of the personal data of its users.\u00a0The present case will enable the Court to clarify the extent of the powers of intervention of supervisory authorities such as ULD [German DPA] with regard to the processing of personal data which involves the participation of several parties.\u201d<\/p>\n It\u2019s fair to say that EU Member States\u2019 data protection authorities are a spectrum, with some taking a distinctly more proactively pro-privacy stance than others.<\/p>\n While Ireland\u2019s low corporate tax rate is something of a flag for where the country plants its priorities on the \u2018data for businesses\u2019 vs \u2018privacy for users\u2019 axis \u2014 underlining why Facebook might want to be subject to its supervision vs other, more pro-privacy EU DPAs.<\/p>\n But its preference for the Irish data protection commissioner to be its sole privacy authority could well be on borrowed time. A spokeswoman for the ECJ said there is no date yet for a final judgment but one usually follows between three and six months after the opinion.<\/p>\n Contacted for a response to today\u2019s advocate general\u2019s opinion, a Facebook spokesperson told us: \u201cWe respectfully disagree with the Advocate General and await the European Court\u2019s decision.\u201d<\/p>\n Facebook\u2019s spokesperson further emphasized the AG\u2019s opinion is non-binding. However AG opinions are usually highly influential on the court \u2014 though we\u2019ll have to wait to see whether the court concurs in this instance. (If so there could be wider implications for other, similarly structured tech companies that also use tracking cookies in the EU.)<\/p>\n The Facebook spokesperson also sought to imply that the AG\u2019s opinion is not consistent with an incoming update to EU data protection law, under the GDPR \u2014 which comes into force in May 2018, and includes a provision intended to reduce data oversight complexity for companies operating services across EU Member States borders via a so called one-stop shop mechanism that\u2019s designed to limit the number of DPAs data controllers need to liaise with.<\/p>\n However the mechanism does not mean data oversight is automatically limited to a single DPA; rather the GDPR provides for a lead DPA which can liaise with any other concerned authorities over data issues pertaining to citizens in their own territories. So in fact it allows for multiple concerned DPAs to carry out supervision on companies\u2019 data-related practices.<\/p>\n The AG also touches on this area, writing: \u201c[T]he Court should not, in my opinion, pre-empt the scheme established by the general regulation on data protection which will apply from 25 May 2018 onwards. As part of that scheme a one-stop-shop mechanism is instituted. This means that a controller that carries out cross-border data processing, such as Facebook, will have only one supervisory authority as interlocutor, namely the lead supervisory authority, which will be the authority for the place where the controller\u2019s main establishment is located. Nevertheless, that scheme, and the sophisticated cooperation mechanism which it introduces, are not yet applicable.\u201d<\/p>\n Another interesting component of the opinion pertains to the definition of a data controller \u2014 a key distinction in privacy law which enables supervisory authorities to understand where specific legal responsibilities lie, and thus how to apply data protection law.<\/p>\n In the case of the German company involved in the original case, the AG\u2019s view is that both it and Facebook share responsibility for data processing as regards the Facebook fan page, as both are involved with making decisions around how user data is processed (one as administer of the specific Facebook fan page; the other, Facebook, as administrating entity of Facebook fan pages).<\/p>\n But the wider point of note is that neither needs to have complete control over data processing activities to be deemed a data controller from a legal point of view.<\/p>\n \u201cEver more frequently data processing is complex, comprising several distinct processes which involve numerous parties which themselves have differing degrees of control. Consequently, any interpretation which focusses on the existence of complete control over all aspects of data processing is likely to result in serious lacunae in the protection of personal data,\u201d writes the AG.<\/p>\n \u201cI would add that, as the Belgian Government rightly observes, the fact that the Wirtschaftsakademie [the German company in the case] acts as joint controller in so far as it decides to have recourse to Facebook\u2019s services for its information offering in no way relieves Facebook Inc. or Facebook Ireland of their obligations as controllers. Indeed, it is clear that those two entities have a decisive influence over the purposes and means of the processing of personal data which occurs when a fan page is visited and that they also use that data for their own purposes and interests.\u201d<\/p>\n The AG also writes in support of \u201ca broad interpretation of the concept of \u2018controller\u2019\u201d saying this is necessary for EU data protection law to function as intended.<\/p>\n <\/p>\n Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/yhYRN4LjQ34\/<\/p>","protected":false},"excerpt":{"rendered":" Facebook\u2019s European business may not, for too much longer, be able to rely on its preferred privacy buffer of arguing that data protection oversight of its business is exclusively limited <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-9719","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t