When a ‘Like’ is not a ‘Like’: A New Fragmented Approach to Data Controllership
Forthcoming (2020) Modern Law Review
27 Pages Posted: 11 Feb 2020 Last revised: 30 Apr 2020
Date Written: January 1, 2019
In Fashion ID, the Court of Justice of the European Union (‘CJEU’) held that an operator of a website featuring a Facebook ‘Like’ button is a data controller under EU Directive 95/46 (‘Directive’) jointly with Facebook in respect of the collection and transmission of the personal data of website visitors to Facebook, but Facebook alone is a data controller for any subsequent data processing. While the CJEUs expansive interpretation of joint controllership aims to leave ‘no gaps’ in the protection of individuals, we question whether the proposed solution to ‘fragment’ controllership into different stages of processing helps to achieve that goal. We argue that CJEUs ‘fragmented’ approach is incompatible with the GDPR, as it does not reveal the intended purposes of data processing, and thus negates informed and specific consent. We suggest that such ‘fragmentation’ undermines the consistency, predictability and transparency of EU data protection law by obscuring the pervasiveness of data commodification in the digital economy.
Keywords: data protection, data privacy, cookies, General Data Protection Regulation, Court of Justice of European Union, EU, data controller, joint data controllership, consent, data processing, Facebook, marketing, data-driven marketing
Suggested Citation: Suggested Citation