The European Court of Justice (ECJ) ruled Monday that companies embedding the Facebook “Like” button on their websites may be liable for collecting customer data and transferring it to Facebook.
The ruling came in response to a German online retailer, Fashion ID, transmitting prospective customers’ personal data to Facebook Ireland when those individuals visited the company’s website. The Higher Regional Court of Düsseldorf, Germany, had requested the ECJ interpret applicable provisions of the Data Protection Directive of 1995.
A press release stated that the court held that “Fashion ID cannot be considered to be a controller in respect of the operations involving data processing carried out by Facebook Ireland after those data have been transmitted to the latter.”
However, the court found that Fashion ID could be considered a joint controller in its operations and associations with Facebook. “By contrast, Fashion ID can be considered to be a controller jointly with Facebook Ireland in respect of the operations involving the collection and disclosure by transmission to Facebook Ireland of the data at issue.”
The court further held that Fashion ID must obtain consent from its online visitors regarding these joint operations, specifically in its role in “the collection and transmission of data.”