ECJ Latest Facebook Ruling Makes Waves: Impact Under The GDPR?

In its decision C-210/16 of 5 June 2018, the European Court of Justice (ECJ) ruled on a dispute between a German academic institution and a German data protection authority. The institution operated a fan page on Facebook and collected user data via cookies, which were placed by means of a function called "Facebook Insights". The purpose of the data collection was to provide statistics to administrators of fan pages and to publish targeted advertisements. The data protection authority ordered the institution to stop collecting the data and to deactivate its fan page, since the authority identified deficiencies in the information provided about the data collection.

The institution challenged the order by denying its legal liability for the processing of personal data on Facebook. It also denied having provided instructions to Facebook as regards data processing and claimed that the German data protection authority should have taken action directly against Facebook,