After another statement by the German Data Protection Authorities (German DPAs) of 5 September 2018 (Statement, available in English here), stating that the operation of a fan page as offered by Facebook was illegal, Facebook reacted "overnight" and released a co-controller agreement, the "Page Insights Controller Addendum" (Insights Addendum, available here). In a press release of 16 November 2018 (Press Release, available in German here), the Berlin Data Protection Authority (Berlin DPA) announced that it has been auditing organisations concerning the use of Facebook fan pages since early November. In this blog, we provide recommendations as to what organisations should do next.
On 5 June 2018, the Court of Justice of the European Union (CJEU) handed down its judgment (Case C-210/16), holding that the operator of a fan page on Facebook is jointly responsible with Facebook for processing the data of visitors to the fan page. Only a day later, the German DPAs released their first statement on the consequences of the judgment, arguing that organisations do not meet data protection standards when operating a fan page on Facebook, leaving marketers in Germany and Europe with lots of uncertainty (for more background, please review our previous blog How big is the risk to operate Facebook fan pages in Germany?). Three months then passed without Facebook providing any solution to the operators of fan pages.
German DPAs reiterate that Facebook fan pages were illegal
In its Statement, the German DPAs noted that Facebook has not yet made any statement on how it plans to enable fan pages to be operated lawfully and criticised the fact that a co-controller agreement has not yet been made available. The German DPAs concluded that operating a fan page as offered by Facebook was illegal and demanded that data protection requirements are fulfilled when operating a fan page. The German DPAs also noted that they are working together with the other European authorities to make a coordinated approach towards Facebook.
Facebook has released Insights Addendum
Only a day after the Statement was released, Facebook made available the Insights Addendum. The Insights Addendum applies to the processing of personal data in connection with the analytics tool Facebook Insights (Insights Data) and provides, in particular, that
Facebook Ireland and the operator of a fan page are co-controllers; Facebook Ireland takes primary responsibility under the General...