Fashion ID is an online retailer for fashion items, on whose website a plugin from Facebook (“Like” button) is integrated. If a user visits this website, information about the IP address of this user and the browser string are transmitted to Facebook, regardless of whether the user clicks the “Like” button or has a Facebook account. Cookies are also installed by Facebook on the user’s device. A German consumer protection association had filed an action for an injunction against this. The Düsseldorf Higher Regional Court had submitted a reference for a preliminary ruling to the ECJ.
In his Opinion of December 19, 2018, the Advocate General essentially suggests to the ECJ that the one who has embedded a plugin provided by a third party in his website (which causes the collection and transfer of personal user data) is considered a controller within the meaning of Art. 2 lit. d of Directive 95/46. However, the (joint) responsibility is limited to those processing operations for which he actually contributes to the decision on the means and purposes of the processing of the personal data. On the question of liability, the Advocate General also expresses a restrictive view to the effect that the defendant’s liability must be limited to the phase of data processing in which it was actually involved and may not be extended to any subsequent phases of data processing if these took place outside the sphere of influence and possibly also without the defendant’s knowledge.
Furthermore, the Advocate General is of the opinion that the provisions of Art. 7 lit. a of Directive 95/46, the data subject’s consent must be declared to the website operator who has integrated the third-party content into his website. The consent of the data subject and the information within the meaning of Art. 10 would have to be provided before the collection and transfer of the data took place.
It is interesting that in this case the Advocate General considers joint processing to exist even if there is no parameterization by the
website operator (as was the case in the proceedings regarding the operator of a Facebook fan page (C-216/16)), but the integration of a plug-in appears sufficient.