Judgment — ECLI:EU:C:2018:388
Date: 2018-06-05
Language of the case: German
Court formation: Grand Chamber
Subject matter: Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

summary of the order for reference]. 25 What is important in the present case is not the determination of the purposes and means of the data processing which occurs after the transmission to Facebook of the data of people who have visited a fan page. The focus must be on the phase of the processing that is in issue here, that is to say, the collection of the data of people who visit a fan page, without their first being informed thereof or giving their consent thereto. 26 It is apparent from Facebook’s terms and conditions of use that viewing statistics provide the fan page administrator with information about his target audience, so that he can create content that is more relevant to it. Viewing statistics provide the fan page administrator with demographic data concerning the target audience, including trends in terms of age, sex, personal and professional status, information on the life styles and centres of interest of the target audience and information on the purchasing habits of the target audience, including on-line purchasing, the categories of goods and services that appeal the most and geographic data which tell the administrator where to make special offers and where to organise events. 27 See, to that effect, Opinion 1/2010, p. 26. 28 Ibid., p. 28: ‘the imbalance in the contractual power of a small data controller with respect to big service providers should not be considered as a justification for the controller to accept clauses and terms of contracts which are not in compliance with data protection laws’. 29 C‑131/12, EU:C:2014:317. 30 Judgment of 13 May 2014, Google Spain and Google (C‑131/12, EU:C:2014:317, paragraph 38 and, to the same effect, paragraph 83). 31 Judgment of 13 May 2014, Google Spain and Google (C‑131/12, EU:C:2014:317, paragraph 40). 32 Paragraph 35 of the order for reference, [paragraph 18 of the English summary of the order for reference]. 33 Pending before the Court. 34 As the Swiss data protection authority notes, ‘although the recording and analysis, in the strict sense, of data are in most cases carried out discretely by providers of web tracking services, website operators have equal responsibility. They embed the code of the web tracking services provider in their websites and thus enable the transmission of data, the downloading of cookies and the collection of data for the benefit of the provider of the web tracking services all without the knowledge of the Internet user’ see ‘Explications concernant le webtracking’ of the Préposé fédéral à la protection des données et à la transparence (PFPDT) (Federal Data Protection and Transparency Commissioner, Switzerland) at the following Internet address: https://www.edoeb.admin.ch/datenschutz/00683/01103/01104/index.html?lang=fr. 35 See, to that effect, Opinion 1/2010, p. 24. 36 Opinion 1/2010, pp. 32 and 33. 37 Opinion 1/2010, p. 19. 38 See paragraph 40 of the order for reference, [paragraph 22 of the English summary of the order for reference]. 39 See, inter alia, the judgment of 31 January 2017, Lounani (C‑573/14, EU:C:2017:71, paragraph 56 and the case-law cited). 40 ‘Opinion 8/2010’. 41 Opinion 8/2010, p. 31. 42 Opinion 8/2010, p. 32. 43 The structures which groups like Google and Facebook adopt for conducting their business throughout the world makes it difficult to determine which national law applies and to identify the establishment against which individuals that have suffered harm and supervisory authorities may take action. See, on these point, Svantesson D., ‘Enforcing Privacy Across Different Jurisdictions’, in Enforcing Privacy –Regulatory, Legal and Technological Approaches, Springer, Berlin, 2016, pp. 195 to 222, especially pp. 216 to 218. 44 See, in particular, the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 25 and the case-law cited). 45 See, in particular, the judgment of 28 July 2016, Verein für Konsumenteninformation (C‑191/15, EU:C:2016:612, paragraph 75 and the case-law cited). 46 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 29). 47 See, in particular, the judgment of 28 July 2016, Verein für Konsumenteninformation (C‑191/15, EU:C:2016:612, paragraph 77 and the case-law cited). 48 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 29). 49 See, in particular, the judgment of 28 July 2016, Verein für Konsumenteninformation (C‑191/15, EU:C:2016:612, paragraph 78 and the case-law cited). 50 Opinion 8/2010, p. 33. See also, to that effect, p. 15 of the Opinion. 51 C‑131/12, EU:C:2014:317. 52 Paragraph 55 of the judgment. 53 Paragraph 56 of the judgment. 54 Paragraph 57 of the judgment. 55 See, to that effect, Opinion 5/2009 of 12 June 2009 on on-line social networks of the Article 29 working group, p. 5. 56 C‑131/12, EU:C:2014:317. 57 See, in particular, ‘Update of Opinion 8/2010 on applicable law in light of the CJEU judgment in Google Spain’ by the Article 29 working party, 16 December 2015, pp. 6 and 7. 58 As regards the possible application of the laws of several Member States, see Opinion 8/2010: ‘the reference to “an” establishment means that the applicability of a Member State’s law will be triggered by the location of an establishment of the controller in that Member State, and other Member States’ laws could be triggered by the location of other establishments of that controller in those Member States’ (p. 29). 59 C‑191/15, EU:C:2016:612. 60 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (OJ 2016 L 119, p. 1). 61 See, on this point, Hawkes B., ‘The Irish DPA and Its Approach to Data Protection’, in Enforcing Privacy: Regulatory, Legal and Technological Approaches, Springer, Berlin, 2016, pp. 441 to 454, especially p. 450, footnote 11. The author states that ‘the degree to which, under existing EU law, other European DPAs can assert jurisdiction over entities such as Facebook Ireland is not entirely clear, linked as it is to interpretations of Article 4 of Directive 95/46/EC, notably the phrase “the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State”. The DPC, in its audit report, stated that “it ha(d) jurisdiction over the personal data processing activities of [Facebook Ireland] based on it being established in Ireland” but that this “should not however be interpreted as asserted sole jurisdiction over the activities of Facebook in the EU.”’ 62 C‑131/12, EU:C:2014:317. 63 See, following similar logic, Common Statement by the Contact Group of the Data Protection Authorities of The Netherlands, France, Spain, Hamburg and Belgium, 16 May 2017, in which those authorities stated the following: ‘... the DPAs united in the Contact Group conclude that their respective national data protection law applies to the processing of personal data of users and non-users by the Facebook Group in their respective countries and that each DPA has competence. Following case-law from the European Court of Justice …, the DPAs note that the Facebook Group has offices in multiple countries in the EU. These offices aim to promote and increase the sales of targeted advertising aimed at national users and non-users of the service. For its revenues, the Facebook Group almost completely depends on the sale of advertising space, and personal data must necessarily be processed for the type of targeted advertising services offered by the Facebook Group. Therefore, the activities of these offices are “inextricably linked” to the data processing by the Facebook Group, and all the investigated national offices are relevant establishments under Article 4(1)(a) of the European Data Protection Directive 95/46/EC.’ 64 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 49). 65 C‑230/14, EU:C:2015:639. 66 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 42). 67 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 43). 68 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 55). 69 See the judgment of 1 October 2015, Weltimmo (C‑230/14, EU:C:2015:639, paragraph 57). 70 C‑230/14, EU:C:2015:639. 71 C‑230/14, EU:C:2015:639. 72 See, in this regard, point 44 of this Opinion. 73 See also points 73 to 77 of this Opinion. 74 C‑230/14, EU:C:2015:639. 75 Judgment of 1 October 2015, Weltimmo (C-230/14, EU:C:2015:639, paragraph 60). 76 Judgment of 1 October 2015, Weltimmo (C-230/14, EU:C:2015:639, paragraph 57).