Wirtschaftsakademie: When a Facebook Page Creates Joint Control

Case C-210/16 | Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH | Court of Justice of the European Union | Grand Chamber | 5 June 2018

Practice Takeaways: ① Anonymous reports do not settle controller status. Examine the personal data processing used to produce them. ② Platform settings can establish participation in determining purposes and means. Audience selection and statistical parameters matter. ③ Access to the underlying personal data is unnecessary for joint control. ④ Joint responsibility need not be equal. Each participant’s role requires assessment. ⑤ Using another company’s platform does not remove an administrator’s own obligations.

Can an organization be responsible for personal data that it never receives? And can operating a page on someone else’s platform involve enough influence over processing to make the organization a controller?

In Wirtschaftsakademie, the Court answered both questions by examining the administrator’s contribution to the processing behind Facebook’s audience statistics. Facebook designed and operated the infrastructure. But the administrator helped determine how that infrastructure processed visitors’ data for its own promotional purposes.

The judgment interpreted Directive 95/46, the GDPR’s predecessor. Its analysis of controller status remains relevant to the corresponding definition in Article 4(7) GDPR. Its separate conclusions about supervisory authorities’ powers require attention to the different enforcement framework then applicable.

Practice Tip: Start with the processing that produces an analytics report. The format of the report an organization receives does not, by itself, establish its role in the collection and use of the underlying data.

What happened

Wirtschaftsakademie Schleswig-Holstein, a German company providing educational services, operated a Facebook fan page. Administrators could obtain anonymous statistics about page visitors through Facebook Insights, a free service offered under nonnegotiable conditions. (Judgment, paras. 14–15.)

• Those statistics depended on personal data processing. Facebook placed cookies containing unique user codes on visitors’ devices. The codes could be matched with connection data for registered Facebook users and were collected and processed when fan pages were opened. According to the referring court, neither Wirtschaftsakademie nor Facebook Ireland informed visitors about the cookies’ storage and operation or the subsequent processing during the relevant period. (Judgment, para. 15.)

On 3 November 2011, Schleswig-Holstein’s supervisory authority, the ULD, ordered Wirtschaftsakademie to deactivate its page. The authority considered that creating the page actively contributed to Facebook’s collection of visitors’ personal data, from which Wirtschaftsakademie benefited through the resulting statistics. (Judgment, paras. 16–17.)

Wirtschaftsakademie challenged the order. It argued that Facebook’s processing could not be attributed to it, that it had not commissioned Facebook to process data under its control, and that the authority should have acted against Facebook directly. (Judgment, para. 18.)

The German administrative courts set aside the order. The Federal Administrative Court subsequently referred questions to the CJEU concerning controller status, applicable national law, and supervisory authorities’ powers where Facebook’s activities were divided among entities in different Member States. (Judgment, paras. 19–24.)

Why the case matters

The case addresses a recurring feature of digital services: an organization receives a convenient output while a platform performs the personal data processing needed to generate it.

• An audience report may contain no identifiable individuals. Yet the organization’s choices about its audience, promotional objectives, and statistical criteria may help shape the processing that occurs before the report is produced.

An anonymous output does not erase an organization’s participation in the personal data processing behind it.

The judgment also explains why joint control can accommodate unequal influence. A platform’s dominant role does not necessarily exclude the participation of an organization using its services. The assessment concerns what each participant contributes to determining the purposes and means of the relevant processing.

Key holding

The Court reached three principal conclusions:

1. The fan page administrator was a joint controller. Through parameters reflecting its target audience and promotional objectives, the administrator participated in determining the purposes and means of processing visitors’ personal data. Receiving only anonymous statistics did not prevent that classification. (Judgment, paras. 36–44.)
2. The German authority could exercise powers concerning Facebook’s German establishment. Under the Directive, Facebook Germany’s advertising activities were sufficiently connected to the processing, even though responsibility for collecting and processing personal data within the group was allocated elsewhere. (Judgment, paras. 52–64.)
3. The German authority could assess the processing independently of the Irish authority. In the circumstances addressed, it could act against an entity established in Germany without first requesting intervention by the Irish supervisory authority. (Judgment, paras. 65–74.)

The Court’s analysis

1. A platform’s control does not exclude another participant’s control

The Directive defined a controller as a person or body determining the purposes and means of processing, alone or jointly with others. The Court emphasized that this broad definition serves effective and complete protection of the individuals concerned. Several actors can therefore participate in the same processing and be subject to the applicable requirements. (Judgment, paras. 26–29.)

• Facebook Inc. and Facebook Ireland primarily determined the purposes and means of the processing at issue. That was not disputed. The question was whether the page administrator also contributed to those determinations. (Judgment, paras. 30–31.)
• The Court expressly distinguished ordinary use of a social network from operating the fan page at issue. Merely using Facebook did not make every user a joint controller of the network’s processing. A fan page administrator, however, created an opportunity for Facebook to place cookies on visitors’ devices and participated through the page’s configuration. (Judgment, paras. 35–36.)

Practice Tip: Identify the organization’s actual contribution. Choosing a platform is relevant context, but the analysis should examine how the organization’s decisions shape the particular processing.

2. Audience and statistical parameters helped determine purposes and means

Creating the page involved defining parameters linked to the administrator’s target audience and its objectives in managing and promoting its activities. Those choices influenced the processing used to produce visitor statistics. Facebook’s filters allowed the administrator to define statistical criteria and designate categories of people whose personal data would be used. (Judgment, para. 36.)

• The available information could concern demographic trends, lifestyles and interests, purchasing habits, and geographical distribution. These statistics helped the administrator decide what content to offer, where to make special offers, and where to organize events. (Judgment, para. 37.)
• The administrator consequently participated in determining why and how visitors’ personal data were processed. Its influence operated through tools Facebook supplied; it did not require designing the underlying technology. (Judgment, paras. 36–39.)

For analytics arrangements configuration choices matter because they connect an organization’s own objectives to the processing performed by a platform.

Practice Tip: Include audience settings, filters, and reporting criteria in controller assessments. They may reveal influence over processing that a review confined to technical infrastructure would miss.

3. Anonymous statistics did not remove responsibility for the underlying processing

Wirtschaftsakademie received audience statistics in anonymous form. The Court accepted that characterization but examined how those statistics were generated.

• Their production depended on the prior collection and processing of visitors’ personal data through Facebook’s cookies. Where several operators were jointly responsible for the same processing, the Directive did not require each operator to have access to the personal data. (Judgment, para. 38.)
• The distinction is between the information delivered to the administrator and the processing in which the administrator participated.

An anonymous report may fall outside personal data rules as an output while the operations used to produce it remain subject to those rules.

The Court therefore classified the administrator as a controller jointly with Facebook Ireland for the processing identified in the case. (Judgment, para. 39.)

Practice Tip: Separate two questions: “Does the report contain personal data?” and “What role does the recipient play in the personal data processing that generates it?” An answer to the first does not resolve the second.

4. Visitors did not need Facebook accounts

The fan page could also be visited by people who were not registered Facebook users. The Court considered the administrator’s responsibility particularly significant for those visitors because simply consulting the page automatically initiated processing of their personal data. (Judgment, para. 41.)

• Recognizing joint responsibility helped protect everyone visiting the page, including people who had no account on the social network. (Judgment, para. 42.)

For an organization reviewing a public-facing platform page, the relevant population therefore extends beyond followers, subscribers, and registered platform users.

5. Joint responsibility did not mean equal responsibility

The Court qualified its broad approach to controller status with an important distinction: joint responsibility does not necessarily imply equal responsibility.

• Participants may be involved at different stages and to different degrees. Each participant’s level of responsibility must be assessed against all relevant circumstances. (Judgment, para. 43.)
• Facebook’s primary role in designing and operating the system could coexist with the administrator’s more limited contribution. The existence of that contribution did not establish that the administrator bore identical responsibility for every operation performed by Facebook.

Practice Tip: After identifying joint control, examine each participant’s role in the relevant operations. A shared classification does not substitute for assessing the scope and degree of each participant’s responsibility.

6. Facebook’s internal division of tasks did not determine the German authority’s powers

The Court separately considered whether Facebook’s corporate structure restricted the German authority’s ability to act.

• Under Article 4(1)(a) of the Directive, the relevant connection was processing carried out in the context of an establishment’s activities. The establishment did not have to perform the processing itself. (Judgment, paras. 51–57.)
• Facebook Germany promoted and sold advertising space to the German market. The processing at issue helped Facebook improve its advertising system. Because those activities were inextricably linked, the processing occurred in the context of Facebook Germany’s activities for purposes of the Directive. (Judgment, paras. 58–60.)

German law therefore applied, and the German supervisory authority could exercise the relevant powers concerning the German establishment. Allocating data processing responsibility to Facebook Ireland within the group did not defeat that conclusion. (Judgment, paras. 61–64.)

7. Cooperation did not require deference to another authority

The Directive required supervisory authorities to cooperate. It did not establish priority among them or require an authority to follow another Member State authority’s assessment. (Judgment, paras. 68–70.)

• The German authority could consequently assess the processing independently of the Irish authority and exercise its powers against the entity established in Germany without first asking the Irish authority to intervene. (Judgment, paras. 71–74.)

NOTE: The conclusions in (6) and (7) above concern the Directive’s enforcement system. They should not be treated as permission to bypass the GDPR’s separate rules on supervisory competence, lead authorities, and cooperation.

The Advocate General’s Opinion

Advocate General Yves Bot proposed substantially the same conclusions in his Opinion of 24 October 2017.

• On controller status, he emphasized practical influence over the purposes and means of processing. Creating and operating the page enabled collection, while selecting statistical criteria influenced how Facebook’s tools were used. The administrator sought audience information for its own promotional objectives. (Opinion, points 52–59.)
• He also rejected an assessment based solely on contractual allocations. Nonnegotiable platform terms, unequal bargaining power, and lack of access to the data did not exclude controller status where the administrator exercised actual influence. Complete control over every aspect of processing was unnecessary. (Opinion, points 60–65.)
• The Opinion expressly discussed the then-pending Fashion ID case, drawing a connection between fan pages and websites using social plugins that transmitted visitors’ data to Facebook. That discussion anticipated the related questions raised by organizations incorporating platform functionality into their own online activities. (Opinion, points 66–72.)
• Finally, the Advocate General distinguished shared responsibility from equal responsibility. The Court expressly relied on that part of his analysis. (Opinion, points 75–76; Judgment, para. 43.)

I fail to see any fundamental difference between the position of a fan page administrator and that of the operator of a website that embeds in its website a programming code of a provider of web tracking services, thus enabling the transmission of data, the downloading of cookies and the collection of data for the benefit of the provider of the web tracking services all without the knowledge of the Internet user. (Opinion, points 69)

What the Court did—and did not—decide

The Court established that a fan page administrator could jointly determine processing through parameters tied to its audience and promotional objectives. Access to the underlying personal data was unnecessary, and anonymous statistics did not resolve responsibility for the processing used to produce them.

It did not hold that every social network user is a joint controller. Nor did it assign the administrator equal responsibility for every processing operation performed by Facebook.

The judgment also did not establish a general rule that consent is always required for every comparable analytics activity. Although the dispute arose from alleged failures to inform visitors about cookies and processing, the Court’s answers concerned controller status and supervisory powers. It did not provide a complete assessment of every substantive condition governing the processing.

Finally, the CJEU supplied interpretations for the national court; its preliminary ruling did not itself finally dispose of the challenge to the deactivation order.

Under the GDPR, Article 26 separately requires joint controllers to allocate their compliance responsibilities transparently through an arrangement, except insofar as applicable Union or Member State law determines those responsibilities. The arrangement’s essence must be available to individuals, who may exercise their rights against each controller.

Conclusion

Wirtschaftsakademie shows why controller assessments must reach beyond the data an organization receives.

An administrator that helps shape audience analysis for its own objectives may participate in determining the processing behind the resulting statistics. The platform can perform the technical operations and retain the personal data while the administrator still shares control.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-210/16, Wirtschaftsakademie Schleswig-Holstein.

• Court of Justice of the European Union, Grand Chamber, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, Judgment of 5 June 2018, ECLI:EU:C:2018:388.
• Opinion of Advocate General Yves Bot, Case C-210/16, delivered 24 October 2017. 

GDPR: Regulation (EU) 2016/679, particularly Articles 4(7), 26, 55, 56, and 60. These provide the corresponding controller definition and the GDPR’s separate rules on joint-controller arrangements and supervision. Read the Regulation.

Useful reading from The de la Torre Review

• Jehovan: When Door-to-Door Notes Create Joint Control — Applies joint-control principles to decentralized religious outreach. Citing Wirtschaftsakademie, the Court explains why access to the data is unnecessary and why participants’ responsibility need not be equal. Read the Article.
• Google Spain: The “Right to Be Forgotten”—While the Past Remains Online — Explains the broad, functional understanding of controller status that Wirtschaftsakademie draws on. The judgment also supplies the establishment analysis used to connect local advertising activities with personal data processing performed elsewhere. Read the Article.
• Weltimmo: When One Representative May Create a Local Establishment — Explains the flexible, factual approach to establishment that Wirtschaftsakademie draws on when assessing Facebook’s German operations. It also distinguishes applicable national law from supervisory powers, providing context for why local advertising activities could support enforcement even when processing responsibility was allocated elsewhere within the group. Read the Article.
• Fashion ID: When a Facebook “Like” Button Makes a Website a Joint Controller — Develops Wirtschaftsakademie’s joint-control analysis in the context of an embedded social plugin. Explains why a website operator can jointly control collection and transmission without accessing the data, while remaining outside controller responsibility for subsequent processing whose purposes and means it does not determine. Read the Article.
• What Is a Controller? — Explains the functional test underlying Wirtschaftsakademie: controller status depends on an organization’s actual influence over the purposes and means of processing, rather than its title or contractual designation. Provides the foundation for understanding why configuring audience statistics can create controller responsibilities even without access to the underlying personal data. Read the Article.
• What Are ‘Joint Controllers’ (a.k.a. ‘Co-Controllers’)? — Examines how organizations jointly determine processing, why their participation need not be equal, and how they allocate responsibilities under Article 26 GDPR. Provides the broader framework for Wirtschaftsakademie’s conclusion that a page administrator can share control with a platform while bearing a different degree of responsibility. Read the Article.