German Data Protection authorities broaden application of German Data Protection Law to foreign social networks and attack the use of social plugins and fanpages

Dr Fabian Niemann, Lennart Schüßler, and Ruth Boardman write:

The Düsseldorfer Kreis (“Düsseldorf Circle”), an informal body of all German Data Protection Authorities (“DPAs”), has published a decision concerning the application of German data protection rules to social networks. The decision reflects the common view of all German DPAs and comments (i) on the (very broad) applicability of German Data Protection Law and on (ii) strict conditions for companies using fanpages and/or which include “like-buttons” on their websites. According to the German Data Protection Authorities, such companies are themselves responsible if the operator of a social network collects user data in a non-compliant way.