On July 29, 2019, the European Court of Justice issued a judgement in the case C-40/17, also known as the Fashion ID case. The ruling addresses website operators’ data protection responsibilities in the context of third-party features.
A social plugin collects personal data when embedded on a website. The court held that an operator of a website with an embedded social plugin, e.g. the Facebook “Like” button, is considered joint data controller with the provider of the plugin. However, the responsibilities of the website operator only apply for the collection and transmission of personal data, excluding subsequent processing of the personal data.
Due to the fact that the data processing begins when the user visits the website, valid consent from the user shall be obtained by the website owner – provided that consent is required according to applicable legislation. The same applies regarding the duty to inform users of the data processing.
The ruling in its entirety can be found under the link below.
Time Advokatbyrå continuously provides advice within the field of data protection. If you would like to know more about this ruling or need assistance with data protection legislation, please reach out to Alexander Berger, head of Data Privacy.