Facebook subject to German data protection law, court rules
A recent decision from the High Court of Berlin rules that Facebook is subject to German data protection law.
The ruling contradicts a previous ruling by the Administrative Court of Appeals of the Federal State of Schleswig-Holstein, which ruled in April last year that Irish data protection rules applied over German data processing, since German user data was processed in Facebook’s European headquarters in Ireland. Facebook’s offices in Germany focused on marketing and sales and did not process user data, the court said.
But, last month, the High Court of Berlin contended that Facebook processed user data in the US. Consequently, EU law did not apply and Germany’s own data protection legislation was to be enforced. The High Court also confirmed a decision in 2012 that ruled that Facebook’s ‘Friend Finder’ violated German data protection law as users were not made aware that using the service would import their entire address book.
The decision means that Facebook will need to review its terms of service and privacy policies, parts of which are now against German law. Consumer protection organisations have hailed the ruling as a key success. In a statement to out-law.com, policy officer for the Federation of German Consumer Organizations (VZBV) Michaela Zinke stated that the ruling’s main value was in showing that “American companies like Facebook have to abide by local data protection law “. However, Zinke further advised that legal uncertainty would remain until Germany’s Federal Supreme Court gave a ruling on the case.
According to out-law.com, Zinke further said that “… the Berlin court’s judgment is the more convincing of the two in terms of its interpretation and application of data protection laws. The Schleswig-Holstein Administrative Court of Appeals did not determine whether it was Facebook’s US-based business or Facebook Ireland that controlled the processing of German users’ personal data or where the processing of German users’ personal data took place and instead decided it was irrelevant whether the controller was based inside or outside of the EU”.
Despite this, addressing PCWorld project manager of the VZBW, Carola Elbrecht notes that the Higher Court of Berlin and the Schleswig-Holstein Administrative Court of Appeals are equals, so it is difficult to establish which ruling will prevail. If Facebook decides to appeal against the Higher Court’s decision they may file a formal objection within one month.
Facebook has said that it is reviewing the Higher Court’s decision.
Facebook subject to German data protection rules, says Berlin court (26.02.14)
http://www.out-law.com/en/articles/2014/february/facebook-subject-to-german-data-protection-rules-says-berlin-court/
Facebook must comply with German data protection law, court rules (18.02.14)
http://www.pcworld.com/article/2098720/facebook-must-comply-with-german-data-protection-law-court-rules.html
Facebook loses privacy case in Germany, may help Europeans protect data (18.02.14)
http://www.digitaltrends.com/social-media/facebook-must-comply-with-privacy-rules-in-germany-berlin-court-says/#!zieWH
(Contribution by Andrew Walsh – EDRi)