www.curia.europa.eu

The German company Wirtschaftsakademie Schleswig-Holstein operates in the field of education.

It offers educational services inter alia by means of a fan page

hosted on Facebook at the address

www.facebook.com/wirtschaftsakademie.

Administrators of fan pages, such as Wirtschaftsakademie, can obtain anonymous statistical data

on visitors to the fan pages via a function called ‘Facebook Insights’ which Facebook makes

available to them free of charge under non-negotiable conditions of use. The data is collected by

supervisory authority within the meaning of Directive 95/46 on data protection, with the task of

supervising the application in the Land of Schleswig-Holstein of the provisions adopted by

Germany pursuant to that directive, ordered Wirtschaftsakademie to deactivate its fan page.

According to the Unabhängiges Landeszentrum, neither Wirtschaftsakademie nor Facebook

informed visitors to the fan page that Facebook, by means of cookies, collected personal data

concerning them and then processed the data.

Wirtschaftsakademie brought an action against that decision before the German administrative

courts, arguing that the processing of personal data by Facebook could not be attributed to it, and

that it had not commissioned Facebook to process data that it controlled or was able to influence.

Wirtschaftsakademie concluded that the Unabhängiges Landeszentrum should have acted directly

with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). This

directive was repealed with effect from 25 May 2018 by Regulation (EU) 2016/679 of the European Parliament and of the

Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the

free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, OJ 2016 L 119,

p. 1).

Fan pages are user accounts that can be set up on Facebook by individuals or businesses. To do so, the author of the

fan page, after registering with Facebook, can use the platform designed by Facebook to introduce himself to the users

of that social network and to persons visiting the fan page, and to post any kind of communication in the media and

opinion market.

www.curia.europa.eu

as a controller jointly responsible, within the EU, with Facebook Ireland for the processing

of that data.

Such an administrator takes part, by its definition of parameters (depending in particular on its

target audience and the objectives of manging or promoting its own activities), in the

determination of the purposes and means of processing the personal data of the visitors to

its fan page. In particular, the Court notes that the administrator of the fan page can ask for

demographic data (in anonymised form) – and thereby request the processing of that data –

concerning its target audience (including trends in terms of age, sex, relationships and

occupations), information on the lifestyles and centres of interests of the target audience (including

information on the purchases and online purchasing habits of visitors to its page, and the

The Court states that the recognition of joint responsibility of the operator of the social network and

the administrator of a fan page hosted on that network in relation to the processing of the personal

data of visitors to that fan page contributes to ensuring more complete protection of the rights of

persons visiting a fan page, in accordance with the requirements of Directive 95/46 on data

protection.

In addition, the Court finds that the Unabhängiges Landeszentrum is competent, for the

purpose of ensuring compliance in German territory with the rules on the protection of

personal data, to exercise with respect not only to Wirtschaftsakademie but also to

Facebook Ireland all the powers conferred on it under the national provisions transposing

Directive 95/46.

solely for the sale of advertising space and other marketing activities in the territory of the Member

State concerned and, second, exclusive responsibility for collecting and processing personal data

belongs, for the entire territory of the EU, to an establishment situated in another Member State (in

this case, Facebook Ireland).

The Court further states that, where the supervisory authority of a Member State (in this case, the

Unabhängiges Landeszentrum in Germany) intends to exercise with respect to an entity

established in the territory of that Member State (in this case, Wirtschaftsakademie) the powers of

intervention provided for in Directive 95/46,

protection of personal data committed by a third party responsible for the processing of that data

More precisely, Article 28(3) of Directive 95/46.

In particular the power to order the blocking, erasure or destruction of data, or to impose a temporary or definitive ban

on processing (Article 28(3) of Directive 95/46).

www.curia.europa.eu

of intervention with respect to the entity established in its territory without first calling on

the supervisory authority of the other Member State to intervene.

NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes

which have been brought before them, to refer questions to the Court of Justice about the interpretation of

European Union law or the validity of a European Union act. The Court of Justice does not decide the

dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s

decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.