1. Operators of Facebook fan pages must act to avoid data protection violation
On 6 June 2018, the German data protection authorities released a Statement noting that the decision of the Court of Justice of the European Union (CJEU) (case no. C-210/16) on Facebook fan pages dated 5 June 2018 has direct consequences for all companies that have a Facebook fan page. According to the Statement, Facebook and the fan page operators are jointly responsible for the entire operation of the fan page, and not only for 'Facebook Insights' as ruled by the CJEU. One of the requirements will be to enter into a joint-controller data protection agreement with Facebook.
Conclusion: These decisions highlight legal risks companies bear in using not only Facebook, but also many other social platforms. Facebook is expected to publish their suggestion for a joint-controller agreement with fan page operators within the next couple of weeks. See more details on our blog.
2. German data protection authorities' stance on cookies – only with opt-in consent in the future?
In April 2018, the German data protection authorities (German DPAs) released a highly criticised position paper on the relation of the German Telemedia Act and the General Data Protection Regulation (Position Paper, available in German here). The Position Paper clearly states that tracking and profiling cookies now require informed consent via prior opt-in.
Conclusion: The Position Paper remains vague in many parts; in particular, it is difficult to understand why the German DPAs only take consent into consideration as a legal basis for tracking and profiling cookies. We understand that the decision by the German DPAs was not unanimous, and so expect more guidance from them to follow. Please read more on this on our blog.
3. Berlin Regional Court: Labelling of influencer advertising of products purchased by self
In its judgment of 24 May 2018 (case no. 52 O 101/18) the Berlin Regional Court held that, in certain circumstances, influencers may be required to label their posts even if they have bought the relevant products themselves. In particular, there was a commercial action by the influencer. Posts from an influencer with over 50,000 followers would be likely to attract the attention of linked organisations interested in establishing a business relationship.
Conclusion: The judgment reaffirms the strict case law on the labelling obligations of influencers, but, at the same time, leaves influencers in a position of legal uncertainty. However, the judgment does not state that influencers must label each post as commercial, but rather an overall assessment of all circumstances must be made.
4. Dresden Court of Appeal confirms case law on appropriation of contents
In its judgment of 6 March 2018 (case no. 4 U 1403/17), the Dresden Court of Appeal ruled that operators of review sites make user ratings on the site their own if they edit or delete the content. This is particularly the case if the operator carries out such actions without prior consultation with the author of the rating in question.
Conclusion: The decision confirms previous court rulings, according to which operators of review sites are liable themselves and not as indirect interferers, if they carry out editorial checks of ratings for correctness and completeness.
5. Berlin Court of Appeal: Rights holders do not need to be protected from 'framing' by technical measures
On 18 June 2018, the Berlin Court of Appeal (case no. 24 U 146/17) held that collecting societies may not restrict the granting of licensing agreements relating to the use of their inventory of images (which are protected under German copyright law) as thumbnails to only those licensees that implement technical measures to ensure that third parties cannot include such images on their websites by means of 'framing'. The court further rejected attempts by rights holders to restrict their consent to framing by notices on the original website, provided that the rights holders made the particular image freely accessible to all internet users on the original website.
Conclusion: Rights holders cannot restrict their consent to publication on a specific, freely accessible website, and so website operators can frame freely accessible third-party content on their websites. However, the operators must bear in mind that this general rule applies only to content that was originally lawfully published. Please read more on this decision on our blog.
6. Cologne Court of Appeal: The German Act on the Protection of Copyright in Works of Art and Photographs (KUG) continues to apply after the GDPR has entered into effect
by Dr. Philipp Süss, LL.M. and Dr. Alexander Hardinghaus, LL.M.
In its decision of 18 June 2018 (case no. 15 W 27/18), the Cologne Court of Appeal allowed the release of a certain television programme, ruling that the German Act on the Protection of Copyright in Works of Art and Photographs (KUG) prevails, within its scope, over conflicting provisions of the GDPR.
The Cologne Court of Appeal held that the applicant could not rely on the provisions of the GDPR. Article 85 GDPR allows EU Member States to adopt national legislation that departs from the provisions of the GDPR when personal data is processed for journalistic purposes. In the view of the Cologne Court of Appeal, this holds true for section 23(1) no. 1 KUG, which was applicable in the underlying case. According to this provision, the image of a living person may be published without that person's consent if the image is of historical importance.
Conclusion: The decision of the Cologne Court of Appeal is the first published decision dealing with the relationship between the GDPR and the KUG. It remains to be seen whether other German courts will share its view.
New laws and recommended reads in the areas of EU/German IT and data protection law
New laws
- New draft proposal for the ePrivacy Regulation of the Council of the EU. Statement of the European Data Protection Board on the ePrivacy Regulation.
- Proposal of the German government for Trade Secrets Act (available in German only).
- The California Consumer Privacy Act will enter into force on 1 January 2020. More in our Client Alert.
Recommended reads
- Resolution of the EU Parliament, calling for the suspension of the EU-U.S. Privacy Shield. More on our blog.
- German Federal Supreme Court: Facebook account passes on to heirs. More on our blog.
- Munich Court of Appeal: Online retailers must specify the delivery date even for 'coming soon' B2C pre-release orders. More on our blog.
- European Data Protection Board releases its first GDPR guidelines:
- Conference of the German Data Protection Authorities publishes GDPR guidance (in German only) on:
- Conference of the German Data Protection Authorities publishes list of processing operations which are subject to a data protection impact assessment.
- Bavarian DPA's guidance for small businesses on main GDPR requirements.
- DPA Lower Saxony reviews GDPR readiness of 50 organisations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
