Data Protection: Where does “Processing” Occur?

The EU Data Protection Directive, implemented by individual member states, is to be applied even where the data controller is located outside the EU, but uses equipment located within the EU to process that personal data.  The High Court of Berlin has been reviewing a case brought against Facebook by the Federation of German Consumer Organisations.  The group claimed that Facebook was in breach of German data protection law by sending emails to non-users without their consent through use of the “Friend Finder” feature.

Most significantly, the High Court placed particular importance on the use of cookies.  Holding that Facebook, as a data controller, used “equipment” in Germany when it placed cookies on the devices of German users, regardless of whether they were Facebook users.  This is significant since Facebook, a US company argued that any German data was controlled and processes from its operations in Ireland and therefore, Irish data protection laws applied to it.  Yet the High Court held that Facebook did not provide sufficient evidence to demonstrate that its Irish operations actually made the decisions expected from a data controller, rather the US operations was the decision maker.

This ruling is contrary to that handed down by the Schleswig-Holstein Administrative Court of Appeals last year,  which ruled that Facebook was not subject to local  (German) data protection laws.  The Administrative Court of Appeals did not address the question of whether the Irish or US operations controlled the processing of German users’ personal data.  Rather found that the Irish operation’s participation of the blocking of anonymous accounts was sufficient to render a decision.

This most recent decision is important since most online advertising companies use cookies to track consumer preferences in order to more specifically target relevant advertising materials.  Should this decision stand it is likely that characterizing the placement of cookies onto a consumer’s device as using equipment would subject US companies, in particular, to much closer scrutiny by many countries.

Need assistance? Please contact us and see how we can help.