German data protection law applies to Facebook

When internet service providers are involved, must they comply with data protection rules from which state in the case of cross-border data flows? International data protection law or the EU data protection directive should be consulted here. The Berlin Chamber Court (Kammergericht) has now decided that applicable law governing Facebook vis-à-vis German users is German data protection law. In doing so, however, the Berlin Chamber Court makes a different decision for international internet corporations such as Facebook, Google and the like than the Higher Administrative Court of Schleswig (OVG Schleswig), which assumes that Irish data protection law applies to Facebook.

Unlike the OVG Schleswig the Chamber Court in its judgment of 24.01.2014 applies German data protection law by relying inter alia on the European data protection directive and considering whether Facebook's US parent company uses certain "means" for data processing in Germany. The court assumes that by using cookies on the personal computers of domestic users, the US parent company employs such means. Furthermore, the court allocates the data processing facilities of the contracted German internet service provider to the American parent company as its own means used in Germany.

Unlike the OVG Schleswig, the Chamber Court did not consider the activities of the European subsidiary in Ireland as establishing the applicability of Irish data protection law. In the Chamber Court's view, the European subsidiary had not demonstrated its own effective and actual data processing vis-à-vis its American parent company by means of its own data processing facilities and own personnel. Furthermore, Facebook Ireland Ltd. does not bear responsibility for data processing, as it lacks the actual decision-making power as a 100% subsidiary.

Furthermore, unlike the OVG Schleswig, the Chamber Court decided that Facebook and the user had effectively agreed on the application of German data protection law in any case. The fact that the applicability of public law cannot be contractually agreed upon does not stand in the way, because German data protection law contains at least also private law rules (such as the statutorily provided right to damages of the user).

An appeal was not permitted.

Conclusion

The judgment of the Chamber Court represents a further decision in the debate concerning which data protection law applies to the provision of internet services by international corporations (for Google see the decision of the Regional Court (LG) Berlin). The jurisprudence of the (appellate) courts is not uniform and it remains to be seen how further courts will decide.