European Data Protection Digest

Schleswig-Holstein commissioner orders site owners to deactivate analytics

August 19, 2011

 

The Independent Centre for Privacy Protection (ULD)—the privacy regulator for the German state of Schleswig-Holstein—has told website owners in that state to “shut down their fan pages on Facebook and remove social plug-ins such as the ‘like’ button” from their sites.

In a press release, the ULD said that “after a thorough legal and technical analysis,” it concluded that use of such features violates the German Telemedia Act, the Federal Data Protection Act and the Data Protection Act of Schleswig-Holstein. 

From the ULD press release:

“By using the Facebook service, traffic and content data are transferred into the U.S.A, and a qualified feedback is sent back to the website owner concerning the web page usage, the so called web analytics (Ger.:Reichweitenanalyse”). Whoever visits facebook.com or uses a plug-in must expect that he or she will be tracked by the company for two years. Facebook builds a broad individual and for members even a personalized profile. Such a profiling infringes German and European data protection law. There is no sufficient information of users and there is no choice; the wording in the conditions of use and privacy statements of Facebook does not nearly meet the legal requirements relevant for compliance of legal notice, privacy consent and general terms of use.”

The ULD calls for Schleswig-Holstein website owners to immediately deactivate the services. “If this does not take place by the end of September 2011, ULD will take further steps,” the release states. 

ULD International Coordinator Kirsten Bock told the IAPP Europe Data Protection Digest that the ULD will levy fines against sites that fail to comply, “but only after having gone through the formal procedures in each and every case and as a last resort. We still hope to solve the issue in a more constructive way,” Bock said.

Data Protection Commissioner Thilo Weichert, head of the ULD, said his organisation “has pointed out informally for some time that many Facebook offerings are in conflict with the law,” but website owners continue to use them.

Weichert added that “Institutions must be aware that they cannot shift their responsibility for data privacy” onto non-German enterprises and users.

He also promised more action.

“Our current call is only the beginning of a continuing privacy impact analysis of Facebook applications” Weichert said. “ULD will continue in cooperation with other German data protection authorities.”

Commissioner Weichert has issued similar provocative proclamations in the past. Notably, in 2010 he called for the dismantling of the U.S. Safe Harbor program.

—IAPP Staff