German data protection law at Facebook?

The Independent State Centre for Data Protection in Schleswig-Holstein (ULD) had ordered Facebook Inc./USA and Facebook Ireland Ltd. to comply with the requirements of German data protection law. The Higher Regional Court of Schleswig-Holstein (OVG Schleswig) then had to decide whether German data protection law applies to Facebook's services with regard to German users.

Anyone who registers with Facebook must provide their genuine data ("real names"); otherwise, Facebook blocks the user account. However, according to the data protection provisions in the Telemediengesetz (TMG), the service provider must enable the use of telemedia anonymously or under a pseudonym, insofar as this is technically possible and reasonable, and must inform the user accordingly of this possibility.

Facebook challenged the orders issued by the ULD before the Administrative Court of Schleswig (VG Schleswig).

The VG Schleswig decided in its orders of 14.02.2013 – Az. 8 B 61/12 and Az. 8 B 60/12 in favour of Facebook, because German data protection law does not apply to the processing of data of German users. Accordingly, the disputed provisions of the TMG could not apply to data processing at Facebook.

The ULD filed an appeal against the orders of the VG Schleswig.

Decision of the court

The OVG Schleswig also decided in favour of Facebook (orders of 22.04.2013 – Az. 4 MB 10/13 and 4 MB 11/13).

The court based its decision on whether Facebook Ireland Ltd. constitutes an "establishment" within the meaning of the European Data Protection Directive. The term is broadly construed and merely requires the effective and actual exercise of an activity by means of a fixed establishment. For the court, it was "obvious" that Facebook Ireland Ltd. fulfilled these requirements for an "establishment".

The court further established that the activity of Facebook's Irish establishment, Facebook Ireland Ltd., was indeed the processing of the relevant personal data. In doing so, it referred to the statements of the Irish Data Protection Commissioner regarding Facebook Ireland Ltd in his Report of Audit which likewise concluded that Facebook Ireland Ltd. was the only entity and legally the company within the Facebook Group that controlled the data of non-North American users. By contrast, Facebook Germany GmbH was merely active in the area of advertising acquisition and in the area of marketing.

Once a presence in the territory of the EU or the EEA, which could be regarded as an "establishment", exists, the law of the Member State where that establishment is established must be applied. The court took the view that for this reason it was also not necessary to address data processing by Akamai (also based in Germany) (use of so-called Content Delivery Networks (CDN)) and the direct collection of personal data by Facebook Inc. via technical means.

The orders of the OVG Schleswig are final and not subject to appeal.

The ULD stated in its press release that it would comply with Facebook's objections in the main proceedings.

Conclusion

According to the case law of the OVG Schleswig, German users cannot rely on German data protection law vis-à-vis Facebook. However, the question of applicable law is disputed and was decided differently in the case of Bundesverbands der Verbraucherzentralen und Verbraucherverbände (vzbv)/Facebook and also in the case of vzbv/Google . It remains to be seen how other courts will decide on this matter.