1. Joint controllership for social plugins

by Friederike Detmering, M.A.

In a case (docket no.: C40/17) submitted to the European Court of Justice (ECJ) by the Düsseldorf Regional Court, Advocate General Bobek, in his Opinion of December 19, 2018, took the view that website operators and Facebook are joint controllers for the integration of social plugins (Art. 26 GDPR). Specifically, website operators and Facebook jointly determined the means and purposes of data processing during the phase of data collection and the initiation phase of data transfer to Facebook. In the advocate general’s opinion, both actors pursued commercial and economic goals, irrespective of the fact that their goals were not completely identical.

Conclusion: Should the ECJ follow the advocate general’s opinion, website operators will need to conclude a joint controller agreement pursuant to Art. 26 GDPR with Facebook, obtain the users’ consent (if necessary) and inform them pursuant to the GDPR.

2. Bavarian DPA on Facebook Custom Audience consent

by Sven Schonhofen, LL.M.

Kristin Benedikt of the Bavarian DPA gave an interview on the use of Facebook Custom Audience (“CA”) on February 25, 2019. She has reiterated that the use of CA via email list as well as via pixel requires consent. Consent for CA via email can be obtained in connection with a purchase in an online shop or registration for a newsletter. However, Benedikt noted that there must be a separate checkbox for the consent to CA via email list.

Conclusion: For the first time, a supervisory authority has commented on linking consent for CA via email with newsletter consent or a purchase in an online shop. To be on the safe side, organizations must implement a separate, unticked checkbox.

3. ECJ on media privilege on YouTube videos by “amateur journalists”

by Dr. Andreas Splittgerber

On February 14, 2019, the European Court of Justice (ECJ) ruled (docket no.: C-345/17) that the media privilege under data protection law (formerly Art. 9 EU Directive 95/46, now recital 153 GDPR) may in principle also apply to videos published on YouTube by nonprofessional journalists. Consequently, amateur journalists do not have to obtain the prior consent of data subjects or inform them pursuant to data protection rights, provided that (i) no personal rights of third parties are opposed, and (ii) the amateur journalist had the exclusive purpose of disseminating information, opinions or ideas to the public.

Conclusion: The judgment can probably also be applied to other forms of media, e.g. blog posts. In any case, freedom of expression (media privilege) and personal rights must be weighed against each other.

4. Influencer advertising update

by Dr. Philipp Süss, LL.M. / Dr. Alexander Hardinghaus, LL.M.

After the German State Media Authorities published their joint guidance paper on “labelling of advertising on social media offerings” in November 2018 (more on our blog), a recent ruling from the Berlin Court of Appeals dated January 8, 2019 (docket no.: 5 U 83/18) gives some more legal certainty. In the court’s view, where the influencer does not receive any compensation for tagging or linking the respective companies or products, such tagging or linking as such does not automatically trigger a duty of the influencer to label the respective post as advertising. Rather, such posts may qualify as an editorial contribution or expression of opinion.

Conclusion: Influencers who attach tags or links to companies or products to their posts without receiving any consideration should arrange for a content-related connection between the linked companies or products and their posts if they wish to avoid an advertising obligation.

5. ECJ: Limited space to provide information on withdrawal rights

by Christian Leuthner

Under certain circumstances, advertisers have limited opportunities to provide information on the right to withdrawal in the context of a distance selling contracts. The European Court of Justice has ruled in a judgment of January 23, 2019 (docket no.: C 430/17) that the decision whether such a case exists or whether the advertiser must choose a different format in order to be able to reproduce the mandatory information, must be made on a case-by-case basis taking into account all technical possibilities for the design of the communication (e.g. typeface, size of the advertisement). If this is the case, the legally prescribed withdrawal form need not be used.

Conclusion: Organizations should carefully examine whether all mandatory information can be represented by reasonable advertising design.

6. Update on copyright law for the digital environment

by Sven Schonhofen, LL.M.

After long negotiations, the trilogue has concluded and a final text for the Directive for Copyright Law in the Digital Single Market (“Directive”) has been agreed upon. The Directive includes, in particular, copyright exceptions for the digital environment (e.g., for text and data mining or online teaching activities), improves licensing practices to ensure wider access to content, introduces a new right for press publishers for the digital use of press publications. The final text of the Directive also includes the already infamous Art. 13, which clarifies the legal framework for online content sharing platforms. Art. 13 sets forth that, in principal, such platforms have to obtain a license for copyright protected works uploaded by users.

Conclusion: The directive shall be formally adopted by the end of March 2019.

7. Austrian DPA: Erasure of personal data through anonymization

by Ramona Kimmich

The Austrian DPA held in a decision of December 5, 2018 (docket no: DSB-D123.270/0009-DSB/2018) that the erasure of personal data pursuant to an erasure request under Art. 17 GDPR is also possible through anonymization. The terms of “erasure” and the final “destruction” of data are not to be understood congruently within the meaning of the GDPR. It is sufficient for the deletion, if the data controller anonymizes the personal data, provided that the reconstruction of the personal data is not possible or possible only with disproportionate effort.

Conclusion: The Austrian DPA allows controllers to select anonymization as means of erasure, but confirmed that anonymization requires that all personal identifiers (such as log files) are gone and de-anonymization is impossible or require disproportionate efforts.

8. Frankfurt Court of Appeals: Clarifying information by using mouse-over effect can
exclude anti-competitive misleading

by Arne Senger, LL.M.

The Frankfurt Court of Appeals decided in its judgment of November 8, 2018 (docket no.: 6 U 77/18) that an information provided by a mouse-over can rule out anti-competitive misconception. Although it ruled in 2011 that the use of this technology was fundamentally insufficient, the court has now assumed that a misconception caused by eye-catching information can be ruled out by a clear and unambiguous indication, provided that the information itself participates in the eye-catcher.

Conclusion: Depending on the design of the mouse-over effect, the notice contents may be sufficient and such advertising design may comply with German unfair competition regulations.

Recommended reading in the areas of EU/German IT and data protection law

New laws

• Geoblocking Regulation.

Recommended reads

• Publications of the European Data Protection Board:
  • First overview over the implementation of the GDPR.
  • Territorial scope of GDPR - more on our blog here and here.
  • Codes of conduct
  • Certification bodies - more on our blog.
  • Clinical trials - more on our blog.
• The Bavarian DPA has audited 40 organizations on the use of tracking tools. More on our blog.
• German DPAs release guidance on whistleblowing hotlines.
• € 50 million fine by the French DPA (CNIL). More on our blog.
• New rules to improve fairness of online platform’s trading practices. More in our client alert.
• European Commission: Draft ethics guidelines for trustworthy artificial intelligence. More on our blog.
• European Commission: Annual review of the Privacy Shield. More on our blog.
• German antitrust watchdog limits Facebook’s scope for collecting and combining data. More in our client alert.
• Brexit update. More on our blog.