EU assesses compliance of Licensed buttons with GDPR

The European Court of Justice is discussing enforcing shared data protection responsibilities on websites that implement widgets that collect data. These include the Facebook Like buttons. That’s what ITPro reports.

A built-in Like button, as well as other regularly implemented widgets, can collect data such as IP addresses when a user loads a website. By enforcing a joint responsibility, not only is Facebook responsible for data protection under the General Data Protection Regulation (GDPR) Privacy Act, but so is the website where it is hosted.

Advocate General Michal Bobek argues that websites, together with the owners of the widgets, should be seen as administrators of data. He thinks that both the website and the owner of the widget seem to voluntarily enable the collection and transmission of data for processing. Although not identical to each other, Bobek argues that there is a commercial purpose and advantage in embedding a social widget. Therefore, the website would also be responsible for the data.

Lawsuit

The Court of Appeal considered the issue following a case with the German online fashion shop Fashion ID. The German consumer group Verbraucherzentrale stated in 2015 that Fashion ID violated the 1995 EU Data Protection Directive (DPD) by placing a Facebook Like button on its site. Fashion ID lost that case in 2016, but appealed with support from Facebook. That court has now sought the opinion of the European Court of Justice.

The case is therefore about the EU’s DPD, not the ASF that came into force earlier this year. However, the AVG is based on a number of elements from the DPD, including a provision for data controllers and processors. It is therefore likely that a decision in this case will also have an impact on future decisions under the new rules.