Case Law · CJEU EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
CJEU: Website operator and social plugin provider must each have legitimate interest for
Original title: FASHION ID GmbH & Co. KG v. VERBRAUCHERZENTRALE NRW eV
Judgment
Summary
Legitimate interest: In a situation such as that at issue in the main proceedings, in which the operator of a website embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider personal data of the visitor, “it is necessary that that operator and that provider each pursue a legitimate interest, […], through those processing operations in order for those operations to be
Full text
summary
Legitimate interest: In a situation such as that at issue in the main proceedings, in which the operator of a website embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider personal data of the visitor, “it is necessary that that operator and that provider each pursue a legitimate interest, […], through those processing operations in order for those operations to be justified in respect of each of them”. (¶¶96–97)
¶96 excerpt
Given that, in the light of the answer to the second question, it seems that, in a situation such as that at issue in the main proceedings, the operator of a website that embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider the personal data of the visitor can be considered to be a controller responsible, jointly with that provider, for operations involving the processing of the personal data of visitors to its website in the form of collection and disclosure by transmission, it is necessary that each of those controllers should pursue a legitimate interest, within the meaning of Article 7(f) of Directive 95/46, through those processing operations in order for those operations to be justified in respect of each of them.
¶97 excerpt
In the light of the findings above, the answer to the fourth question is that, in a situation such as that at issue in the main proceedings, in which the operator of a website embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider personal data of the visitor, it is necessary that that operator and that provider each pursue a legitimate interest, within the meaning of Article 7(f) of Directive 95/46, through those processing operations in order for those operations to be justified in respect of each of them.
How it connects
Related across sources
Guidelines 2/2019 processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects 1 Adopted Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Version 2.0 8 October… Guidelines ·EDPB Oct 16, 2019 Personal Data Processing Child Consent
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent Guidelines ·EDPB May 4, 2020 Consent Data Portability Personal Data
Guidelines 2/2018 derogations of Article 49 under Regulation 2016/679 Guidelines on derogations of Article 49 Guidelines ·EDPB May 25, 2018 Privacy Shield Lawful Basis Legitimate Interest
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
2018 Article 29 Working Party - Guidelines on transparency under Regulation 2016/679 EDPB Apr 11, 2018 Transparency Fairness & Transparency Personal Data
HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or The DPA started an investigation, after receiving 83 complaints from data subjects, against the Ministry of Infrastructure and Transportation (the controller). Particularly,… 17/2026 ·Greece ·Art. 5, 14 Sep 15, 2026 Consent Right to Object Personal Data