When a ‘Like’ Is Not a ‘Like’

In Fashion ID , the Court of Justice of the European Union (‘CJEU’) held that an operator of a website featuring a Facebook ‘Like’ button is a data controller under EU Directive 95/46 (‘Directive’) jointly with Facebook in respect of the collection and transmission of the personal data of website visitors to Facebook, but Facebook alone is a data controller for any subsequent data processing. While the CJEUs expansive interpretation of joint controllership aims to leave ‘no gaps’ in the protection of individuals, we question whether the proposed solution to ‘fragment’ controllership into different stages of processing helps to achieve that goal. We argue that CJEUs ‘fragmented’ approach is incompatible with the GDPR, as it does not reveal the intended purposes of data processing, and thus negates informed and specific consent. We suggest that such ‘fragmentation’ undermines the consistency, predictability and transparency of EU data protection law by obscuring the pervasiveness of data commodification in the digital economy

Business · Citizenship · Commodification · Computer security · Consistency (knowledge bases) · Data Protection Act 1998 · Data Protection Directive · Digital Rights · Directive · Directive on Privacy and Electronic Communications · Economics · European union · European Union law · General Data Protection Regulation · International trade · Internet privacy · Political science · Transparency (behavior) · World Wide Web · Artificial Intelligence · Computer Science · Digitalization, Law, and Regulation · European Criminal Justice and Data Protection · Law · Privacy, Security, and Data Protection