Fashion ID: Operators of websites and social media plugins
CASE C‑40/17, FASHION ID GmbH & Co. KG v. VERBRAUCHERZENTRALE NRW eV, 29 July 2019 (Fashion ID)
(Interveners: Facebook Ireland Ltd and Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.)
Key points:
Representation of data subjects: Articles 22 to 24 of Directive 95/46 must be interpreted as “not precluding national legislation which allows consumer-protection associations to bring or defend legal proceedings against a person allegedly responsible for an infringement of the protection of personal data.” (¶63)
Concept of joint-controllers: The operator of a website, such as Fashion ID, that embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider the personal data of the visitor can be considered to be a controller. That liability is, however, limited to the operation or set of operations involving the processing of personal data in respect of which it actually determines the purposes and means, that is to say, the collection and disclosure by transmission of the data at issue. (¶85)
Legitimate interest: In a situation such as that at issue in the main proceedings, in which the operator of…
