Düsseldorf Regional Court: Incorporation of a "like" button without active indication thereof anti-competitive
Integrating a so-called Facebook "Like" button – especially given the recent heavy criticism of the former Schleswig-Holstein state data protection commissioner – is not exactly straightforward. Up until that point legal practice in this area had been very liberal and did not consider website operators to have a responsibility with regard to the "secret" communication of the button with Facebook. Now a new ruling by the District Court of Düsseldorf has caused further uncertainty (LG Düsseldorf, Judgement of 9th March 2016, Ref. 12 O 151/15).
On 9 March 2016 a website operator was ordered to cease integrating the like button into its website without expressly and unequivocally informing the users of the website of the purpose of the collection and use of the transmitted data at the moment when the provider of the plugin gains access to the IP address and browser string of the user. The operator was also instructed to actively obtain consent from users of the website to the plugin provider accessing their IP addresses and browser string and processing this data before accessing these and to inform the users that this consent may be revoked at any time with future effect.
These requirements are massive and they also deviate considerably from the judicial practice up until that point and the text of data protection law. For example, up until now, there had been no requirement to actively display the privacy statement immediately upon accessing a website, nor to obtain opt-ins in line with privacy law. In fact, public opinion in general proceeds on the assumption that the consent required under data protection laws, in contrast to that under competition laws, may be secured in the form of a so-called opt-out declaration. Not so in the case of Düsseldorf Regional Court. In contrast to the prevailing literature, the Regional Court of Düsseldorf maintains the assumption of responsibility on the part of the website operator with regard to the Like button under Data Protection Law (Section 3 Para. 7 of the German Data Protection Act BDSG). But, as if that weren't enough, the court also calls for consent to be actively obtained immediately upon access to the web presence. This requires action on the part of the user, such as ticking a check box. The Regional Court of Düsseldorf is entering new territory in this respect and it is hoped that the ruling will be overturned by the Higher Regional Court (OLG) promptly and without further ado. After all, otherwise whatever applies to the Facebook would apply to the privacy notices required under Section 13 of the German Telemedia Act (TMG) generally. Then, however, the privacy statement of a website would always have to be displayed upon accessing the site and be actively confirmed by the user. Despite repeated study of the grounds for the judgement, the origin of this requirement of the Regional Court of Düsseldorf remains unclear. Given the lack of a fixed place of jurisdiction when it comes to actions online, every website operator must be prepared for actions to be brought in Düsseldorf. It follows from this that the use of the Facebook Like button should be reconsidered and, where necessary, revised as a matter of urgency. Otherwise there is the threat of costly cease-and desist warnings and cases.
Dr. Robert Kazemi