The Court of Justice of the European Union has recently stated in a decision that administrators of fan pages (like Facebook) must be considered data controllers, despite the fact that the audience statistics compiled by Facebook are transmitted to the fan page administrator only in anonymised form.

The administrator may, with the help of filters made available by Facebook, define the criteria how the statistics are to be drawn up and even designate the categories of persons whose personal data should Facebook use to produce the statistics. Consequently, the administrator of a fan page hosted on Facebook contributes to the processing of the personal data of visitors to its page. In these circumstances, the administrator of a fan page hosted on Facebook must be regarded as taking part, by defining the parameters, in the determination of the purposes and means of processing the personal data of the visitors to its fan page.

Based on the decision of the Court of Justice, the administrator must therefore be categorised in this case as a controller responsible for such processing jointly with Facebook.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.