The Situation: Fashion ID, a German online clothing retailer, embedded on its website the Facebook "Like" button. When a user consults the website of Fashion ID, that user's personal data are transmitted to Facebook Ireland. The transmission occurs regardless of whether the user is a Facebook member or has clicked on the "Like" button.
The Result: On July 29, 2019, the European Court of Justice ("ECJ") ruled (Case C 40/17), following the Opinion of the Advocate General Bobek of December 2018, that Fashion ID and Facebook Ireland are joint controllers with regard to the operations involving the collection and disclosure by transmission to Facebook Ireland. However, Facebook Ireland is the sole controller regarding its processing after such transmission.
Looking Ahead: Besides updating their privacy policies, website operators that use social plugins, such as the Facebook "Like" button, will be required to ensure a legal basis for processing (this will regularly require obtaining consent from users, for example, via a cookie consent tool) and providing appropriate notice to users prior to collecting and transmitting personal data to the social media provider offering the plugin. Additionally, website operators and social media providers will be required to enter into a joint-controller agreement.
Key Facts of the Decisions