On 29 July 2019, the Court of Justice of the European Union
handed down its decision in the Fashion ID case, dealing
with alleged unlawful data collection through the Facebook Like
button and the controllership of said data. In short, the CJEU held
that websites containing embedded third-party content can be joint
controllers in respect of the collection and transmission of such
data, but not the subsequent processing by the third party. Due to
the date of the facts, the case was heard under the Data Protection
Directive; however, the judgment will also be applicable to the
concept of joint controller under the General Data Protection
Regulation.
Background
In 2015, the German consumer protection organisation
Verbraucherzentrale NRW took legal action against Fashion ID,
objecting to the use of a Facebook plug-in on its website. The
plug-in automatically transferred the website user's IP address
to Facebook when the user visited the Fashion ID website, without
the
