On 5 June 2018, the European Court of Justice (ECJ) ruled in a case (C-210/16) concerning data responsibility for Facebook fan pages. In this connection, the ECJ published a statement on 13 June 2018 in which it reviewed the judgment and how it may affect future judgments.

The judgment concerns the interpretation of the rules on controllers in the now abolished personal data directive (directive 95/46, but the Data Protection Agency assesses that the judgment will also have impact on the interpretation of the data protection regulation (regulation 2016/679) as the directive's basic provisions on controllers are continued in the regulation.

The Data Protection Agency’s view on the judgment’s impact on e.g. businesses and authorities with fan pages on Facebook appears from section 5 in the statement. In section 5, the Data Protection Agency states that if you are e.g. a business or an authority with a fax page on Facebook, you must be aware of the following:

“Together with Facebook, you are jointly responsible for observing the rules of the data protection regulation (in relation to the relevant Facebook page).
You must ensure that the persons visiting the page (notwithstanding whether these are Facebook users or not) receive information on the personal data policy and, to the extent required, also provide their consent to the processing.

You must conclude an agreement with Facebook on the joint data responsibility which should govern who is responsible for what and who is to get access to see the most important content of the division of responsibility between Facebook and you.

Persons registered because they have visited your page may exercise their rights vis-à-vis you. This applies e.g. in relation to the right to have access, the right to object or the right to erasure.

In relation to any liability for compensation in connection with the processing of personal data, you and Facebook will be jointly and severally liable.”