Court decision · 5 June 2018
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein
Case C-210/16, ECLI:EU:C:2018:388 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
Using a platform's analytics about your users makes you responsible for that processing even if you only see aggregates.
What happened
An education company ran a Facebook fan page; Facebook used cookies to compile visitor statistics that it offered to the page administrator.
What was decided
The administrator of a fan page on a social network is a joint controller with the network for processing visitors' data, even without access to the raw data.
The legal test applied
- An administrator who configures a platform page and benefits from audience statistics takes part in determining purposes and means
- Joint controllership does not require access to the personal data processed
What would have changed the outcome
- Not configuring audience analytics or targeting parameters reduces the administrator's role
Read the decision at the source
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.